What Are Cybersecurity Education Papers About?

Abstract

Cybersecurity is now more important than ever, and so is education in this field. However, the cybersecurity domain encompasses an extensive set of concepts, which can be taught in different ways and contexts. To understand the state of the art of cybersecurity education and related research, we examine papers from the ACM SIGCSE and ACM ITiCSE conferences. From 2010 to 2019, a total of 1,748 papers were published at these conferences, and 71 of them focus on cybersecurity education. The papers discuss courses, tools, exercises, and teaching approaches. For each paper, we map the covered topics, teaching context, evaluation methods, impact, and the community of authors. We discovered that the technical topic areas are evenly covered (the most prominent being secure programming, network security, and offensive security), and human aspects, such as privacy and social engineering, are present as well. The interventions described in SIGCSE and ITiCSE papers predominantly focus on tertiary education in the USA. The subsequent evaluation mostly consists of collecting students' subjective perceptions via questionnaires. However, less than a third of the papers provide supplementary materials for other educators, and none of the authors published their dataset. Our results provide orientation in the area, a synthesis of trends, and implications for further research. Therefore, they are relevant for instructors, researchers, and anyone new in the field of cybersecurity education. The information we collected and synthesized from individual papers are organized in a publicly available dataset. CCS CONCEPTS• General and reference → Surveys and overviews; • Social and professional topics → Computing education; • Security and privacy;

CryptoScratch: Developing and evaluating a block-based programming tool for teaching K-12 cryptography education using Scratch

“…Several research papers also showcase the importance of cryptography education and tools for improving cybersecurity education and awareness. For instance, Svabensky et al [35] published a systematic literature review of SIGCSE and ITiCSE conference papers from 2010 to 2019. They reported that only a small portion of the papers focused on cryptography among all sub-fields of cybersecurity education across all age groups.…”

“…In particular, works focused on K-12 students were limited. While there is a gap between [35] and now, cryptography in K-12 cybersecurity education is still underrepresented. There are also some excellent prior works to be noted, such as teaching cryptography using an interactive protocol called CYPHER [36], research on secure coding with misuse pattern detection techniques [37] and secure coding for K-12 female students [38].…”

Learn to Train Like You Fight

“…This, combined with the integration of the digital operating environment and physical world, makes its complexity a special feature of the cybersecurity environment (Sinha, 2014;Törngren & Grogan, 2018). Complexity challenges the controllability of the environment and the capacity to operate in it, teach it, and learn the cause-and-effect relationships of related entities (Karjalainen et al, 2019;Moser & Cohen, 2013;Skirpan, 2018;Švábenský, 2020). The cybersecurity operating environment combines elements of different technical entities.…”

Experiencing Cybersecurity One Game at a Time: A Systematic Review of Cybersecurity Digital Games

“…Conventionally, cybersecurity is taught in upper-level undergraduate computer science courses to students who have already learned the fundamentals of computer science and have demonstrated a commitment to computing careers (Dark, 2002;Svabensky et al, 2020). Practically, the effect of the undergraduate bottleneck to formal cybersecurity learning is exacerbated by existing inequities in the K-12 pipeline for computer science as a broader field (Shumba et al, 2013).…”