Journal of The Colloquium for Information Systems Security Education
The Journal of The Colloquium for Information Systems Security Education is a peer-reviewed, open-access publication advancing cybersecurity education, research, and workforce development. It publishes scholarly work focused on cybersecurity pedagogy, curriculum innovation, workforce pathways, AI and automation in security education, governance and policy, and the educational impact of emerging technologies. Articles are openly available under the CC BY 4.0 license, and authors retain full copyright. Submissions are considered from peer-reviewed papers presented at the annual Colloquium for Information Systems Security Education, ensuring a rigorous community-driven review and publication process.
The Colloquium for Information Systems Security Education (CISSE)
Open Access License Notice: This article is © its author(s) and licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0), regardless of any copyright or pricing statements appearing in the PDF. The PDF reflects formatting used for the print edition and not the current open access licensing policy.
What Does An OT Security Professional Need To Know?
Industrial Cybersecurity is an emerging interdisciplinary field of study and practice. This paper presents the results of research and collaboration to create a data-supported and consensus-based curricular guidance document describing the knowledge needed of professionals in the field.
Virtual Gamification in a PBS-based SETA Program
The insider threat remains a significant concern in information security, with self-efficacy and protection motivation emerging as key factors influencing compliance. Security Education Training and Awareness (SETA) programs often address self-efficacy but fail to adequately enhance protection motivation. This paper adopts an educational perspective by incorporating Positive Behavior Support (PBS) pedagogy into a SETA framework, emphasizing the use of virtual gamification and PBS principles to foster a positive, engaging training environment. The proposed nomological model, designed for future testing, evaluates the effects of PBS, gamification, and virtualization on protection motivation and self-efficacy. To bridge the gap between theory and practice, this paper also discusses strategies for direct implementation of PBS-based gamification in organizational settings, such as positive reinforcement, incentivized participation, and adaptive training scenarios. These approaches allow organizations to address immediate security challenges while contributing valuable insights for refining the model. The implications of this research extend beyond compliance, offering a scalable methodology for creating a sustainable, positive organizational security culture.
Using AI Assistants in the Creation of an Academic Program of Study (PoS) in CyberAI
Artificial Intelligence (AI) is playing an increasingly vital role in cybersecurity. As AI becomes more prevalent, cybersecurity professionals need AI skills, and academic institutions need to provide students with the opportunities to gain them. To meet this demand, the NSA National Centers of Academic Excellence in Cybersecurity (NCAE-C) program, in collaboration with the National Science Foundation (NSF), launched an initiative to outline the AI content cybersecurity academic programs need to teach their students. The initiative aims to build knowledge units (KUs) and recommend a Program of Study (PoS) in Cybersecurity and Artificial Intelligence (Cyber AI). This paper outlines the development of an AI assistant that was used to collaborate on the KU creation process for the CyberAI PoS. We will discuss the methodology behind the integration of the AI assistant, evaluate its contributions, and explore future directions for using AI assistants to develop curricular guidelines for academic programs.
The software supply chain and the security of software applications purchased through the Commercial-Off-The-Shelf (COTS) is becoming the focus of government and industry. Higher educational institutions can help by teaching secure supply chain risk management (SCRM), which can help secure COTS software applications. This work presents the results of an experiment that integrated secure SCRM into the software engineering curriculum at Towson University (a diverse, comprehensive institution with a large computer science program). This integration focuses primarily on using the US National Institute of Standards and Technology (NIST) standards to secure COTS software applications effectively. With a focus on undergraduate education, learning modules used in this integration are designed to be injected into almost any course in software engineering curriculum. The overall goal is to provide a model that can be replicated by all universities for integrating secure SCRM into the software engineering curriculum.
Teaching Generative AI for Cybersecurity: A Project-Based Learning Approach
In the Spring 2024 semester, we introduced an elective course titled “Generative AI and Cybersecurity” for MS and upper-division BS students specializing in cybersecurity at our university. The course was designed to equip students with a foundational understanding of Generative AI, particularly large language models (LLMs) like GPT-4, and explore their applications within the field of cybersecurity. Through a combination of classroom instruction, hands-on projects, and industry guest lectures, students engaged with the technical, ethical, and legal dimensions of AI in cybersecurity. The course emphasized practical learning, with students gaining experience in AI tools such as ChatGPT, as well as developing skills in prompt engineering and API usage. While some students were eager for even more technical AI content, they appreciated the hands-on learning, insights from industry guest speakers, and the chance to see how the more powerful models like GPT-4 could be usefully applied to cybersecurity problems.
Reframing Cyber Security for the Next Generation of Digital Activists
This paper presents a novel short course on cyber security designed for secondary school students in the UK. Our approach uniquely frames cyber security within the context of social activism and change-making, aiming to broaden participation and break down entry barriers in the field. The course contextualizes standard cyber security concepts such as information management, privacy, threat modeling, and cryptography within scenarios relevant to young activists. We developed comprehensive lesson plans, interactive activities, and tools like “Change Cards” to facilitate engagement. The course was tested in two educational settings, leading to insights about content delivery and student engagement. Key outcomes include a teacher’s guide and professionally designed resources that have been downloaded by over 1,000 teachers worldwide. Feedback from students and teachers has been overwhelmingly positive, highlighting the course’s relevance to daily life and its effectiveness in improving understanding of security concepts. This project contributes to the field by offering an innovative approach to cyber security education that resonates with young people’s desire for social change, potentially fostering a new generation of diverse cyber security advocates and professionals.
Project-Based Learning in K12 Cybersecurity Education
Teaching adolescents can be challenging, and cybersecurity education is no different. Teachers need to find ways to engage students in the learning by providing some incentives, such as encouraging a sense of curiosity about something in the world around them. In this paper, we discuss one model of instruction, the 5E Model, that has been effective in helping teachers engage students so they have a desire to learn the material. We also discuss the Project-Based Learning method of teaching in which students learn the necessary information for the project as they work through how to complete it. Students’ incentive to learn is based on the need for the learning to solve the problem and complete the capstone project. We combined these two ideas and integrated them into some of the brief activities as well as the project for the week in our summer camp. We will describe two camp activities and then the capstone project and show how the 5E Model was used as the students developed their projects throughout the week. More in-depth learning about the cybersecurity concepts around which the camp was focused built throughout the week. We hope to give others who work with adolescents in informal learning some ideas to help keep students engrossed in the learning opportunities provided to them.
Positioning Cybersecurity as a Pillar of Safety in Occupational Therapy
The rapid digitalization of society has transformed occupational therapy practice, introducing both opportunities and challenges. As occupational therapists increasingly rely on electronic documentation, telehealth, and assistive technologies, cybersecurity is emerging as a critical concern. This position paper argues that occupational therapy is a vital domain for the integration of cybersecurity education, emphasizing the need to safeguard sensitive patient information, enhance digital literacy, and address the unique vulnerabilities faced by occupational therapy clients. The paper outlines the key intersections of occupational therapy and cybersecurity education, highlighting the impact of cyber threats on healthcare, the importance of digital literacy, and the role of occupational therapy in educating and protecting vulnerable populations. Recommendations are provided for integrating cybersecurity education into occupational therapy curricula and fieldwork education to better prepare practitioners for the evolving digital landscape. By integrating cyber safety principles into occupational therapy education, the field can fulfill its mission of enhancing individuals’ participation in meaningful activities by equipping practitioners with the skills necessary to protect patient data, manage evolving digital risks, and ensure safe, effective care in a technology-driven world.
This study extends the research of Ferreira and Teles (2019), who synthesized works by Cialdini (2007), Gragg (2003), and Stajano and Wilson (2011) to propose a unique list of persuasion principles in social engineering. While Ferreira and Teles focused on email subject lines, this research analyzed entire email contents to identify principles of human persuasion in phishing emails. This study also examined the goals and targets of phishing emails, providing a novel contribution to the field. Applying these findings to the ontological model by Mouton et al. (2014) reveals that when social engineers use email for phishing, individuals are the primary targets. The goals are typically unauthorized access, followed by financial gain and service disruption, with ‘Distraction’ as the most commonly used compliance principle. This research highlights the importance of understanding human persuasion in technology-mediated interactions to develop methods for detecting and preventing phishing emails before they reach users. Despite previous identification of luring elements in phishing emails, empirical findings have been inconsistent. For example, Akbar (2014) found 'Authority' and 'Scarcity' most common, while Ferreira et al. (2015) identified 'Liking and Similarity.' In this study, 'Distraction' was most frequently used, followed by 'Deception,' 'Integrity,' and 'Authority.' This paper offers additional insights into phishing email tactics and suggests future solutions should leverage socio-technical principles. Future work will apply this methodology to other social engineering techniques beyond phishing emails, using the ontological model to further inform the research community.
Multidisciplinary Quantum Cybersecurity Research for the Undergraduate Laboratory
Quantum computing has a critical need to be integrated into the undergraduate classroom to meet the needs of cybersecurity education in the 21st Century and to prepare a robust quantum workforce. A cybersecurity laboratory that specializes in undergraduate research explored a pair of quantum security projects in order to develop the foundations of a rich pedagogy to realize these needs: one on cracking pseudo-RSA, and one on understanding the limitations of quantum machine learning in aiding LLM development and refinement. This paper explores why this integration is necessary, explicates the research projects undertaken by these undergraduate researchers, and discusses their contributions to applied quantum security. Our contribution is to provide a template for how to quickly and effectively establish a multidisciplinary quantum security pedagogy for undergraduate students, provide example projects that can be adapted to student interests and abilities, and demonstrate how to enroll students from a wide variety of disciplines, increasing diversity and resiliency in quantum cybersecurity and cybersecurity broadly.
Mentoring Cybersecurity Students in Online Degree Programs
This paper examines the design, implementation, and continuous improvement of a successful mentoring program integrated into cybersecurity capstone courses at Kennesaw State University, aimed at bridging the gap between academic learning and real-world experience. Faced with a need to implement experiential outcomes for cybersecurity graduates, the university introduced a structured mentoring initiative involving industry executives and technical leads to enhance students' professional development, networking opportunities, and practical skills. The program’s structured approach to integrating industry mentorship has contributed to enhanced student engagement and provided valuable experiential learning opportunities. A continuous improvement process, anchored by after-action reviews at the end of each semester, allows the program to evolve in response to participant feedback, ensuring alignment with educational goals and addressing diversity, equity, and inclusion (DEI) challenges in the field. The paper concludes that this mentoring initiative offers students the opportunity to improve outcomes and underscores the importance of integrating experiential learning opportunities within academic curricula. Recommendations for institutions adopting similar programs include prioritizing mentor selection and training, implementing continuous feedback loops, and emphasizing mentor commitment to maximize student benefits.
Enhancing AI-Centered Social Cybersecurity Education through Learning Platform Design
Artificial Intelligence (AI) technologies have become increasingly pervasive in our daily lives. Recent breakthroughs such as large language models (LLMs) are being increasingly used globally to enhance their work methods and boost productivity. However, the advent of these technologies has also brought forth new challenges in the critical area of social cybersecurity. While AI has broadened new frontiers in addressing social issues, such as cyberharassment and cyberbullying, it has also worsened existing social issues such as the generation of hateful content, bias, and demographic prejudices. Although the interplay between AI and social cybersecurity has gained much attention from the research community, very few educational materials have been designed to engage students by integrating AI and socially relevant cybersecurity through an interdisciplinary approach. In this paper, we present our newly designed open-learning platform, which can be used to meet the ever-increasing demand for advanced training in the intersection of AI and social cybersecurity. The designed platform, which consists of hands-on labs and education materials, incorporates the latest research results in AI-based social cybersecurity, such as cyberharassment detection, AI bias and prejudice, and adversarial attacks on AI-powered systems, are implemented using Jupyter Notebook, an open-source interactive computing platform for effective hands-on learning. Through a user study of 201 students from two universities, we demonstrate that students have a better understanding of AI-based social cybersecurity issues and mitigation after doing the labs, and they are enthusiastic about learning to use AI algorithms in addressing social cybersecurity challenges for social good.
Empowering Youth in The Digital Age with Cyber Security Education
As cyberthreats increasingly target vulnerable youth, the need for comprehensive cybersecurity education becomes more critical. Integrating cybersecurity into secondary school curricula offers a promising solution, equipping students with the necessary skills to identify and mitigate cyber risks. Despite the increasing number of cyber risks targeting young people, cybersecurity education in secondary schools is still in its early stages of development. This study investigates the perspectives of 27 secondary school teachers in Wales, United Kingdom, on incorporating cybersecurity education into their curricula. The qualitative insights gathered through semi-structured interviews reveal key challenges and opportunities, including a lack of resources, age-appropriate materials and pedagogical support for teaching cybersecurity. Our findings highlight a need for targeted educational reforms and closer collaboration between schools and cybersecurity professionals. Based on the interview results, we provide practical recommendations for educators, school administrators, and cybersecurity practitioners to enhance secondary cybersecurity education.
Empowering the Next Generation: A Strategic Roadmap for AI in Cybersecurity Education
The integration of artificial intelligence (AI) into cybersecurity is revolutionizing how institutions address increasingly complex cyber threats. As the demand for expertise in both AI and cybersecurity grows, Historically Black Colleges and Universities (HBCUs) have a unique opportunity to develop programs that equip students with the necessary skills to meet these evolving challenges. This paper presents a strategic roadmap for developing AI in Cybersecurity programs at HBCUs, emphasizing interdisciplinary collaboration, hands-on learning, adversarial defense, explainability, ethical leadership, and diversity. To strengthen the roadmap, this paper incorporates real-world case studies from existing AI-cybersecurity programs and proposes strategies to overcome key challenges such as faculty expertise gaps, funding limitations, and resource scalability. Additionally, a framework for evaluating program effectiveness is introduced, offering measurable metrics such as student outcomes, industry collaboration, and curriculum adaptability. By implementing this roadmap, HBCUs can establish sustainable AI in Cybersecurity programs that align with industry needs while fostering leadership and innovation in the cybersecurity workforce.
Historically Black Colleges and Universities (HBCUs)
Efficient Machine Learning for Malware Detection
As the landscape of cyber threats continues to expand, malware detection has become increasingly crucial for maintaining robust cybersecurity. While standard malware detection techniques such as signature-based methods are very effective and widespread, they face certain challenges with zero-day and novel malware. The emergence of artificial intelligence in recent years has led to the development of alternative approaches to this issue, specifically through machine learning techniques. This research aims to analyze the effectiveness and viability of one such machine learning approach; the use of a Convolutional Neural Network (CNN) model for the classification of benign and malicious Windows executable binaries. To accomplish this, we gathered a substantial dataset of both benign and malicious Windows binaries and converted them into grayscale images to train several CNN models with slightly varying architecture for the classification task. Following the training of the models, they were evaluated on an unseen test dataset to compare label predictions against each other, as well as Windows Defender. This approach aims to achieve a definitive metric for determining the effectiveness of this type of malware detection for Windows-based antivirus applications. What we found is that certain CNN models are not only able to perform on par with Windows Defender, but in some cases even outperform them. In conclusion, our study demonstrated that utilizing CNN models with grayscale image conversion of Windows binaries is an effective and efficient approach to malware detection.
Educating the Next Generation of Ethical AI Practitioners
Artificial intelligence (AI) technologies are rapidly advancing, increasing concerns about data privacy harms in AI models. We discuss how ethical AI can be incorporated into computer science curricula. This paper describes the design process for the first ‘AI Privacy Engineering’ course, to the best of our knowledge, taught in the United States. The course is designed for both undergraduate and graduate students at Georgia Tech. Throughout this course, students examine ethical implications of AI system design, development, deployment, and utilization, using the ACM’s General Ethical Principles as an ethical framework. Recognizing that data privacy represents only one possible form of harm, the course blends theoretical and conceptual lectures with hands-on projects that require students to address ethical issues, including bias, fairness, and accountability in AI systems. Herein, we discuss the course design process, including selecting the appropriate body of knowledge, establishing learning objectives, creating assignments, and considering pedagogical methodologies we employed. We explain the empirical methods used to inform our design, including a systematic review of courses teaching AI development at over 40 universities. Our structured curriculum can be used to effectively teach ethical and safe AI, and we propose how these topics may be incorporated more broadly into computer science courses. Finally, we discuss early successes and the challenges faced while teaching the course, particularly in maintaining relevance despite fast-paced changes in the field of AI, an evolving legislative landscape, accessing computational systems to run AI models, and varying levels of student preparedness.
Cybersecurity Threats and Mitigation Strategies in AI Applications
The integration of artificial intelligence (AI) into daily life and critical infrastructure has elevated the importance of addressing cybersecurity concerns within AI applications. While AI systems offer numerous benefits, such as enhanced efficiency, automation, and decision-making, they also introduce novel vulnerabilities and threats. Ensuring the security and reliability of these systems is crucial. This paper investigates key cybersecurity challenges associated with AI, including data privacy, integrity, adversarial attacks, and the ethical implications of AI in security. Additionally, it examines the role of Shapley Additive explainable AI in promoting transparency, allowing for greater interpretability of AI models and insights into decision-making processes.
Cybersecurity High School Innovations: A Path for Educators to Teach Cybersecurity Courses in their Schools
There remains a significant unmet demand for cybersecurity professionals nationwide. Many solutions have been forwarded, but more are needed. Improving opportunities within higher education institutions is important and a critical component of addressing this unmet need, but may do too little too late for many potential cybersecurity professionals. This paper examines the development of an innovative program designed to address this challenge by providing opportunities to secondary educators of all backgrounds. Participants are given an opportunity to learn about cybersecurity and how to bring what they learn back to their own schools and teach it to their students as a standalone course. The program provided a remote component in preparation for an intensive in-person summer summit where participants were brought together at one or more locations. During that time, they would hear from experts in academia, industry, and the military, as well as have an opportunity to practice what they learned through various hands-on labs and activities. Participants from the first year were invited back the second year for a more challenging and advanced experience. During the third year, first and second year participants were invited back such that there were three levels of participants. This paper reports on the findings of this innovative program and provides recommendations for future iterations of similar programs based on lessons learned.
Building a Cybersecurity and AI Integrated Learning Pathway for Criminal Justice Professionals
With support from the National Science Foundation, The University of Washington Tacoma and North Dakota State University have developed scenario-based security curriculum and online showcase labs with interactive simulations and case studies across three progressive courses, revolutionizing cybersecurity education for Criminal Justice (CJ) professionals. By incorporating artificial intelligence into the curriculum, this project enhances CJ professionals’ capabilities. Our goal is to develop a skilled workforce of CJ professionals with cybersecurity and privacy knowledge, addressing the critical need for such cybersecurity expertise in CJ. Literature review, focus group survey results, course framework tailored for CJ professionals, example course modules, and implementation results are presented.
The cybersecurity industry faces a persistent shortage of skilled professionals, as employers report significant challenges in hiring qualified candidates. This study examines the specific technical and non-technical skills that employers find most lacking in new hires and evaluates the importance of practical experience in workforce readiness. Through a survey of 200 senior cybersecurity leaders, we assess which skills are most valued, which are most frequently lacking, and how employer satisfaction varies by education model. The findings indicate that while hands-on experiences, such as real-world projects and capstone work, are linked to higher satisfaction, traditional training programs — including university and boot camp models—show no statistically significant difference in employer satisfaction. Notably, the hiring challenges noted by employers are not fully explained by NICE-aligned technical competencies, underscoring the need for better alignment between training expectations and industry demands. These results emphasize the value of contextualized, practical experience rather than reliance on predefined skill taxonomies.
An Improved Phase Coding Audio Steganography Algorithm
As AI technology continues to advance, voice cloning is becoming increasingly easy. Recently, cases of fraud involving audio forgery using AI technology have emerged, making it particularly important to covertly embed information and verify the authenticity and integrity of audio. Digital Audio Water-marking has thus become a crucial tool in this context. This study proposes an improved Phase Coding audio steganography algorithm that dynamically segments the audio signal and embeds information into the phase components of the mid-frequency range. This approach not only enhances the algorithm’s resistance to steganalysis but also simplifies the computational process, ensuring the authenticity and integrity of audio both efficiently and securely.
AI-Cybersecurity Education Through Designing AI-based Cyberharassment Detection Lab
Cyberharassment is a critical, socially relevant cybersecurity problem because of the adverse effects it can have on targeted groups or individuals. While progress has been made in understanding cyberharassment, its detection, attacks on artificial intelligence (AI) based cyberharassment systems, and the social problems in cyberharassment detectors, little has been done in designing experiential learning educational materials that engage students in this emerging social cybersecurity in the era of AI. Experiential learning opportunities are usually provided through capstone projects and engineering design courses in STEM programs such as computer science. While capstone projects are an excellent example of experiential learning, given the interdisciplinary nature of this emerging social cybersecurity problem, it can be challenging to use them to engage non-computing students without prior knowledge of AI. Because of this, we were motivated to develop a hands-on lab platform that provided experiential learning experiences to non-computing students with little or no background knowledge in AI. We also discussed the lessons learned in developing this lab for non-computing students. In this lab used by social science students at North Carolina A&T University across two semesters (spring and fall) in 2022, students are given a detailed lab manual and are to complete a set of well-detailed tasks. Through this process, students learn AI concepts and the application of AI for cyberharassment detection. Using pre-and post-surveys, we asked students to rate their knowledge or skills in AI and their understanding of the concepts learned. The results revealed that the students moderately understood the concepts of AI and cyberharassment.
A Zero Trust Module for Cybersecurity Education
Zero Trust (ZT) is a conceptual and architectural framework for cybersecurity teams to design networks into secure micro-perimeters and strengthen data security with dynamic and context-aware policies by systematically integrating state-of-the-art technology, risk management, and threat intelligence. Both theoretical analysis and industrial practice have shown that ZT can ensure that organizations are not victims of known attacks or fail to discover a breach for a long time. ZT has recently gained momentum in industry to defend against lateral movement of malicious actors in today’s borderless networks. The United States 2021 President Executive Order requires the federal government must adopt security best practice and advance toward a Zero Trust Architecture (ZTA). However, it is not a trivial task to implement a ZTA due to its novelty and complexity. We need to understand what ZT or ZTA is to take full advantage of it. Therefore, there is a need to introduce the fundamental concepts, principles, and architectures of ZT in cybersecurity courses at a college to better prepare our new cybersecurity professionals for their careers. In the last few years, we have developed a module and used it to introduce ZT in cybersecurity courses at senior undergraduate and graduate levels. This module consists of a lecture to introduce ZT, a homework assignment, and test questions. The lecture includes an introduction to ZT and its principles, design issues in the traditional model of perimeter-based network security, zero trust architectures, security benefits of ZT, technical challenges to implement a ZTA, and the main threats to ZT networks. This article provides an overview of this module with the emphasis on the contents of the lecture. We will also share the experience and lessons we have learned in our teaching practice. Our work will provide a good reference for those who teach cybersecurity courses at a college or university or are developing a cybersecurity curriculum. It will also help busy professors develop or revise a zero-trust module for their cybersecurity courses.
This paper describes the design, implementation and first delivery of a no-cost, no-credit, multi-week virtual bootcamp called Cyber Bridge. The motivation underlying Cyber Bridge is to cast a wider recruitment net by easing the transition of students – especially those from non-technical academic preparations – into cybersecurity studies, particularly at the graduate level. It provides background insights regarding the inception and evolution of the Cyber Bridge project, experimental methodologies and observations, and findings based on analysis of collected metrics and feedback. Results support the view that a Cyber Bridge is a reasonable approach to: increasing students’ comfort level regarding virtual learning environments; introducing and reviewing some cybersecurity foundations; connecting students to additional resources to improve upcoming academic experiences; and moderating their confidence by recognizing knowledge gap areas they may need to review or remediate. Future direction ideas and recommendations are shared that align with a longer-term vision to mobilize this capability to empower more underrepresented, underserved individuals to succeed as cybersecurity professionals and researchers.
<span data-sheets-root="1" data-sheets-value="{"1":2,"2":"Small town governments were once thought to be at a lower risk from cyber threat actors due to their geographical isolation and small digital footprint. The past few years has shown that to be definitively false, with several different threat actors successfully attacking local municipalities, ultimately causing disruptions to critical services, monetary loss, and privacy breaches. With the now ubiquitous presence of the internet, the reality is small city governments are at the same, if not even higher, overall risk of being attacked as large entities. For small municipalities and organizations, there may not be much opportunity to invest additional resources into cyber security due to staffing concerns and limited budgets. This paper will discuss how, while it may seem the overall risk of a cyberattack is lower because these organizations are “small fish”, the probability and impact of an attack are just as high, if not higher in some circumstances, than large, high visibility organizations."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">The following is a partner paper published to the CISSE journal. For more information, please visit the PISCES website. <span data-sheets-root="1" data-sheets-value="{"1":2,"2":"Small town governments were once thought to be at a lower risk from cyber threat actors due to their geographical isolation and small digital footprint. The past few years has shown that to be definitively false, with several different threat actors successfully attacking local municipalities, ultimately causing disruptions to critical services, monetary loss, and privacy breaches. With the now ubiquitous presence of the internet, the reality is small city governments are at the same, if not even higher, overall risk of being attacked as large entities. For small municipalities and organizations, there may not be much opportunity to invest additional resources into cyber security due to staffing concerns and limited budgets. This paper will discuss how, while it may seem the overall risk of a cyberattack is lower because these organizations are “small fish”, the probability and impact of an attack are just as high, if not higher in some circumstances, than large, high visibility organizations."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">Small town governments were once thought to be at a lower risk from cyber threat actors due to their geographical isolation and small digital footprint. The past few years has shown that to be definitively false, with several different threat actors successfully attacking local municipalities, ultimately causing disruptions to critical services, monetary loss, and privacy breaches. With the now ubiquitous presence of the internet, the reality is small city governments are at the same, if not even higher, overall risk of being attacked as large entities. For small municipalities and organizations, there may not be much opportunity to invest additional resources into cyber security due to staffing concerns and limited budgets. This paper will discuss how, while it may seem the overall risk of a cyberattack is lower because these organizations are “small fish”, the probability and impact of an attack are just as high, if not higher in some circumstances, than large, high visibility organizations.
The following is a partner paper published to the CISSE journal. For more information, please visit the PISCES website. <span data-sheets-root="1" data-sheets-value="{"1":2,"2":"The Public Infrastructure Security Cyber Education System (PISCES) program has had significant impact on the cyber security posture of small municipalities and has helped develop qualified entry-level cyber analysts with real-world experience. Due to the ever-evolving nature of cyber security, adjusting our cyber security educational approach to be just as flexible is of dire importance. This paper will address how the PISCES program educates the students and partners with the municipalities, the aspects of cyber security training that PISCES does not cover and makes suggestions on how cyber security training can be applied to other situations."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">The Public Infrastructure Security Cyber Education System (PISCES) program has had significant impact on the cyber security posture of small municipalities and has helped develop qualified entry-level cyber analysts with real-world experience. Due to the ever-evolving nature of cyber security, adjusting our cyber security educational approach to be just as flexible is of dire importance. This paper will address how the PISCES program educates the students and partners with the municipalities, the aspects of cyber security training that PISCES does not cover and makes suggestions on how cyber security training can be applied to other situations.
What Is Interesting and Relevant About Cybersecurity?
<span data-sheets-root="1" data-sheets-value="{"1":2,"2":"Cyber attacks are a common feature of current news and many of them are the result of easy to avoid vulnerabilities in software. It is imperative that students graduating from an undergraduate Computer Science (CS) curriculum understand the consequences of vulnerable code. When developing lessons and assignments, it would be useful to have a sense of students’ attitude toward cybersecurity and appreciation of the need to write secure code. This paper describes an analysis of the results of a survey of students in core CS courses at our large public university, in which students answer free response questions about what they find interesting and relevant about cybersecurity. The survey was conducted in Fall 2022 and repeated in Spring 2023 after cybersecurity interventions were introduced into several core CS courses. We performed a Natural Language Processing (NLP) analysis of the free response answers to determine the overarching themes in the responses. We found that the most prevalent topics students are interested in are cryptography and penetration testing, and did not change over the two semesters. In answer to the question about the relevance of studying cybersecurity, we found that as students progress through the curriculum, what students find relevant moves from protecting their personal data to its importance in job duties and writing secure programs. When developing lessons and assignments, it may be helpful to introduce cryptography or penetration testing to engage students. Also, students should be taught early and often about the relevance of cybersecurity in their future job duties."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">Cyber attacks are a common feature of current news and many of them are the result of easy to avoid vulnerabilities in software. It is imperative that students graduating from an undergraduate Computer Science (CS) curriculum understand the consequences of vulnerable code. When developing lessons and assignments, it would be useful to have a sense of students’ attitude toward cybersecurity and appreciation of the need to write secure code. This paper describes an analysis of the results of a survey of students in core CS courses at our large public university, in which students answer free response questions about what they find interesting and relevant about cybersecurity. The survey was conducted in Fall 2022 and repeated in Spring 2023 after cybersecurity interventions were introduced into several core CS courses. We performed a Natural Language Processing (NLP) analysis of the free response answers to determine the overarching themes in the responses. We found that the most prevalent topics students are interested in are cryptography and penetration testing, and did not change over the two semesters. In answer to the question about the relevance of studying cybersecurity, we found that as students progress through the curriculum, what students find relevant moves from protecting their personal data to its importance in job duties and writing secure programs. When developing lessons and assignments, it may be helpful to introduce cryptography or penetration testing to engage students. Also, students should be taught early and often about the relevance of cybersecurity in their future job duties.
Transforming Cyber Education thru Open to All Accessible Pathways
<span data-sheets-root="1" data-sheets-value="{"1":2,"2":"Boise State University’s (BSU) Cyber Operations and Resilience CORe program was intentionally designed so that any student, especially non-traditional and non-technical students, with an interest in cybersecurity could have an education and training pathway to enter the cyber workforce. The CORe curriculum focuses on teaching students how to design, apply, and improve cybersecurity through the interaction of people, processes, and technology. CORe is a stackable curriculum with elective credit hours and options for various academic and industry certificates and certifications that enable students to customize their unique career pathway. The CORe program guides students to think about the system being managed, the risks presented, and the dynamic intersection of system elements when considering how to incorporate resilience frameworks in achieving a resilient system. By developing systems thinking, the students gain an understanding of the interdependencies interacting with the operational system. The CORe program encourages students to integrate cybersecurity knowledge with models and frameworks found in other academic disciplines through a unifying systems approach. CORe is designed around the realities of today’s broad cyber landscape: that breaches will occur in any system over time and proactive design of resilience into systems to detect, respond, and recover in a timely and orderly manner is critical. Students are taught to think holistically about cybersecurity focusing on all system elements. CORe is not a traditional cybersecurity degree. CORe is distinguished by the non-traditional engineering, computer science approach to cybersecurity education with the singular focus on infusing resilience operations and transdisciplinary systems thinking principles throughout the curriculum."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">Boise State University’s (BSU) Cyber Operations and Resilience CORe program was intentionally designed so that any student, especially non-traditional and non-technical students, with an interest in cybersecurity could have an education and training pathway to enter the cyber workforce. The CORe curriculum focuses on teaching students how to design, apply, and improve cybersecurity through the interaction of people, processes, and technology. CORe is a stackable curriculum with elective credit hours and options for various academic and industry certificates and certifications that enable students to customize their unique career pathway. The CORe program guides students to think about the system being managed, the risks presented, and the dynamic intersection of system elements when considering how to incorporate resilience frameworks in achieving a resilient system. By developing systems thinking, the students gain an understanding of the interdependencies interacting with the operational system. The CORe program encourages students to integrate cybersecurity knowledge with models and frameworks found in other academic disciplines through a unifying systems approach. CORe is designed around the realities of today’s broad cyber landscape: that breaches will occur in any system over time and proactive design of resilience into systems to detect, respond, and recover in a timely and orderly manner is critical. Students are taught to think holistically about cybersecurity focusing on all system elements. CORe is not a traditional cybersecurity degree. CORe is distinguished by the non-traditional engineering, computer science approach to cybersecurity education with the singular focus on infusing resilience operations and transdisciplinary systems thinking principles throughout the curriculum.
Non-traditional cybersecurity curriculum
Remote and asynchronous cybersecurity education model
The Design and Development of Hands-on Activities for Digital Forensics Education
<span data-sheets-root="1" data-sheets-value="{"1":2,"2":"It has been widely admitted by researchers and educators that hands-on activities are a core component in digital forensics education to help students gain practical skills that are needed in real-world forensic investigations. However, it is not clear in existing works about what kinds of hands-on activities are recommended to be integrated into a digital forensics course and how to design and develop them. In our teaching practice, hands-on activities for a digital forensics course are designed in three categories: 1) activities that assist students in learning how to use common digital forensics tools; 2) activities that help students gain in-depth understanding of the basic concepts and fundamental knowledge that are presented in class lectures; 3) activities that promote students the development of mindsets and data analytical skills that are needed for a digital forensic investigator. Various formats are employed to develop these hands-on exercises in different categories. The educational objectives and student learning outcomes map well to the CAE-CD (Centers of Academic Excellence - Cyber Defense) outcomes by completing their forensic knowledge units. In this paper, we share our idea and experience to design and implement such hands-on assignments in each category for meeting specific educational objectives. Sample exercises are briefly described to explain our idea in each category. Open source tools and data sets are introduced for references. Experiences, lessons, and sample feedback from students are discussed. Our results will provide a point of reference for those who teach digital forensics courses at a college or university, or are developing a digital forensic curriculum.\n"}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">It has been widely admitted by researchers and educators that hands-on activities are a core component in digital forensics education to help students gain practical skills that are needed in real-world forensic investigations. However, it is not clear in existing works about what kinds of hands-on activities are recommended to be integrated into a digital forensics course and how to design and develop them. In our teaching practice, hands-on activities for a digital forensics course are designed in three categories: 1) activities that assist students in learning how to use common digital forensics tools; 2) activities that help students gain in-depth understanding of the basic concepts and fundamental knowledge that are presented in class lectures; 3) activities that promote students the development of mindsets and data analytical skills that are needed for a digital forensic investigator. Various formats are employed to develop these hands-on exercises in different categories. The educational objectives and student learning outcomes map well to the CAE-CD (Centers of Academic Excellence - Cyber Defense) outcomes by completing their forensic knowledge units. In this paper, we share our idea and experience to design and implement such hands-on assignments in each category for meeting specific educational objectives. Sample exercises are briefly described to explain our idea in each category. Open source tools and data sets are introduced for references. Experiences, lessons, and sample feedback from students are discussed. Our results will provide a point of reference for those who teach digital forensics courses at a college or university, or are developing a digital forensic curriculum.
Leveraging Gamification and Game-based Learning in Cybersecurity Education
<span data-sheets-root="1" data-sheets-value="{"1":2,"2":"This paper investigates the use of gamification and game-based learning in the field of cybersecurity education. Due to their technical complexity and lack of coherence, traditional pedagogical methods, such as lectures, may fail to engage and inspire students, especially those from non-cyber backgrounds. To address this issue, we devised two distinct cybersecurity frameworks/games based on traditional Capture The Flag (CTF) competitions; an open-ended CTF event and a story-based CTF. Such games have demonstrated potential across multiple disciplines, including computer science, physics, mathematics, and engineering, as well as across multiple levels of study including undergraduate and postgraduate students. The positive feedback and significant increase in the interest to pursue a postgraduate course in cybersecurity, especially among non-cybersecurity students, attest to the success of this gamification strategy. As such, this paper provides valuable insights for enhancing the attractiveness and efficacy of cybersecurity education, thereby encouraging a broader spectrum of non-technical and non-cybersecurity students to pursue this crucial field."}" data-sheets-userformat="{"2":15297,"3":{"1":0},"9":0,"10":0,"11":4,"12":0,"14":{"1":2,"2":0},"15":"Calibri","16":11}">This paper investigates the use of gamification and game-based learning in the field of cybersecurity education. Due to their technical complexity and lack of coherence, traditional pedagogical methods, such as lectures, may fail to engage and inspire students, especially those from non-cyber backgrounds. To address this issue, we devised two distinct cybersecurity frameworks/games based on traditional Capture The Flag (CTF) competitions; an open-ended CTF event and a story-based CTF. Such games have demonstrated potential across multiple disciplines, including computer science, physics, mathematics, and engineering, as well as across multiple levels of study including undergraduate and postgraduate students. The positive feedback and significant increase in the interest to pursue a postgraduate course in cybersecurity, especially among non-cybersecurity students, attest to the success of this gamification strategy. As such, this paper provides valuable insights for enhancing the attractiveness and efficacy of cybersecurity education, thereby encouraging a broader spectrum of non-technical and non-cybersecurity students to pursue this crucial field.