Information Assurance Education Research Articles

Designing Scenarios for In-Organization Training Using the CyberCIEGE Game

Abstract Cyber security awareness training needs to be personalized to address the policies and requirements of a particular organization, although many of the concepts in this training practice are universal. The main reason for the failure of training programs is that the users do not think about applying security concepts. Therefore, the study aims to design scenarios for in-organization training using CyberCEIGE. In this context, CyberCIEGE is considered a flexible and highly interactive video game that is a security awareness tool. It is responsible for supporting organizational training objectives in an engaging security adventure in the presence of typical users. This game has shown success in utilizing information assurance education. The present study indicates that CyberCIEGE is effective in basic information awareness training programs for security purposes, such as the balance between corporate convenience and individual privacy.

A Framework for Improving Information Assurance Education

As a field of growing importance, information assurance is dedicated to protecting our information systems and related assets. In order for this field to deliver on its promise, effective information assurance education, both in the classroom and beyond, is essential. However, relatively little empirical research has been done on the effectiveness of information assurance education in the classroom. Faculty developing and teaching information assurance curricula can choose from differing industry and government standards as well as a range of methods for delivering this education. As a first step toward building a research framework for better assessing the effectiveness of information assurance education, this paper describes an initial research study of information assurance curricula and related teaching methods. Surveys and interviews of faculty teaching information assurance were conducted to determine their assessment of existing standards and the best means for improving the educational experience for students. The results obtained provide the beginning of a framework for further research in this area.

My Student, My Teacher: A Polytechnic Approach to Information Assurance

A polytechnic education involves the practical application of knowledge, including hands-on learning, senior projects, class projects, club activities, professional association activities, and internships. In 1824, the first polytechnic institution in the United States was the Rensselaer School in Troy, New York and today there are approximately 100 polytechnic universities. Several polytechnic institutions are leaders in teaching information assurance. Information assurance educators develop and depend on students to provide leadership in information assurance through active, engaged learning. The goal of this paper is to describe how a polytechnic approach supports information assurance education.

Multifarious initiatives in cybersecurity education

According to the nAtionAl Security council, “president obama has identified cybersecurity as one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter [2].” in may of 2009, the president supported the recommendations from his commissioned cyberspace policy review that, among other endorsements, included promoting cybersecurity awareness and building the digital workforce of the 21st century. the recommendations from the cyberspace policy review were based upon the 2008 comprehensive National cybersecurity initiative (cNci), which consists of 12 individual initiatives designed to help secure the united States in cyberspace. this column will focus on initiative 8 – expand cyber education – as it relates to two-year college programs. First a little background on cNci initiative 8. presently, an insufficient number of cybersecurity practitioners and professionals exist to protect and defend the united States in cyberspace. the current cybersecurity training and education programs are limited in focus and lack unity of effort. Evolving from cNci initiative 8, the National initiative for cybersecurity Education (NicE) was established with the goal of creating “operational, sustainable and continually improving” cybersecurity education that will enhance the nation’s security [8]. the Department of Education and the National Science Foundation (NSF) are serving as co-leads for this NicE component called Formal Cybersecurity Education. the mission of this component is to bolster cybersecurity education programs from kindergarten through graduate school, with an emphasis on science, technology, engineering and mathematics (StEm) disciplines to fill the pipeline with technologicallyskilled and cyber-savvy personnel. During the summer of 2011, an acm innovation and technology in computer Science Education (iticSE) working group studied 16 associate-degree programs in information assurance (a.k.a. cybersecurity). the findings are revealing and in concert with cNci initiative 8. “a lack of consensus of what constitutes information assurance (ia) education has led to ia degree programs with widely varying curricula [10].” associate degree ia programs vary in their particular emphases, their curricular structure, and whether they are meant to place graduates into the workforce or to matriculate students into baccalaureate degree programs. of the 16 associate-degree programs examined by the 2011 working group, 14 were associate of applied Science (a.a.S.) degrees and 2 were associate of Science (a.S.) degrees. of the a.a.S. career programs, two areas of concentration emerged, network security and computer forensics. Figure 1 depicts the composition of a typical network security degree, while Figure 2 illustrates the composition of a typical computer forensics

Integrating Historical Security Jewels in Information Assurance Education

Information assurance (IA) programs are becoming increasingly viable options for computer science and IT students in universities across the US. Although the sophistication of and number of attacks on the cyber domain increase every year, the foundational principles that IA professionals need to learn to advance security and implement new technology remain stable. This article looks at jewels of security education that remain timeless in terms of their teaching value in IA. Secure communication and protocol analysis are key facets of security education, and previous research provides some foundational tenets thereof. These and other jewels give timeless principles to IA professionals for interpreting current practical applications and theoretic limits found in the larger body of security-related research.

An interdisciplinary approach to address identity theft education

An earlier version of this paper was presented at the 2011 IEEE International Symposium on Technology and Society (ISTAS) at Saint Xavier University in Chicago, Illinois (and printed in the 2011 ISTAS proceedings). The focus of this paper is to present observations related to information assurance (IA) in rural and urban populations. Based on our experience teaching college students in these environments, we have noted that on entering school, generally, individuals demonstrate limited background knowledge of a variety of computer related technologies. Students begin with a technical disadvantage that represents a readily exploitable attack vector for identity thieves . Because of the experience deficit, the hazard of identity theft is significant with possible severe detrimental outcomes for the student victim. In addition, the negative impact on the society as a whole is substantial. Methods that reach beyond traditional formal computer or network security instruction in the classroom and extend information assurance education across disciplines are needed. We have explored this direction at the university and have worked on strategies to educate students about identity theft . The interdisciplinary programs outlined here span the curriculum. In addition, we suggest community outreach programs that extend the scope of influence of information assurance education beyond the university to include surrounding at risk populations.

An exploration of the current state of information assurance education

Information Assurance and computer security are serious worldwide concerns of governments, industry, and academia. Computer security is one of the three new focal areas of the ACM/IEEE's Computer Science Curriculum update in 2008. This ACM/IEEE report describes, as the first of its three recent trends, "the emergence of security as a major area of concern." The importance of Information Assurance and Information Assurance education is not limited to the United States. Other nations, including the United Kingdom, Australia, New Zealand, Canada, and other members from NATO countries and the EU, have inquired as to how they may be able to establish Information Assurance education programs in their own country. The goal of this document is to explore the space of various existing Information Assurance educational standards and guidelines, and how they may serve as a basis for helping to define the field of Information Assurance. It was necessary for this working group to study what has been done for other areas of computing. For example, computer science (CS 2008 and associate-degree CS 2009), information technology (IT 2008), and software engineering (SE 2004), all have available curricular guidelines. In its exploration of existing government, industry, and academic Information Assurance guidelines and standards, as well as in its discovery of what guidance is being provided for other areas of computing, the working group has developed this paper as a foundation, or a starting point, for creating an appropriate set of guidelines for Information Assurance education. In researching the space of existing guidelines and standards, several challenges and opportunities to Information Assurance education were discovered. These are briefly described and discussed, and some next steps suggested.

Building a repository of network traffic captures for information assurance education

Network traffic analysis is one of the essential skills of information security professionals. To help students develop these skills, pre-recorded network trace files were needed so students could ...

Information Assurance Education: A Work In Progress

The recognition that we need improved computer security education has increased over the past several years. Recent cyberattacks in Georgia and Estonia exemplify the new threats faced by economies that rely on the Internet. Thus, more people see the need to protect cyberspace-which translates into improving computer security in all aspects of computer use-as crucial for everyone, not merely for those who work with technology. In this column, we reflect on emerging opportunities and challenges in instruction as well as the need for increasing the partnerships among industry, government, and academia to foster mutual understanding of challenges and joint participation in solutions.

The development of an information assurance program

As the world continues to move further into the Information Age, the need to protect information and information systems becomes more critical. UALR is meeting this challenge by providing an Information Assurance Minor program and pursuing designation as a Center of Academic Excellence in Information Assurance Education (CAEIAE). These initiatives are designed to increase the number and skills of information assurance professionals in Arkansas. This paper briefly describes information assurance, the motivation and requirements for the CAEIAE program, and the steps taken at UALR to address the need for skilled information assurance professionals.

カーネギーメロン大学における情報保障教育について

カーネギーメロン大学における情報保障教育について

Phishing for user security awareness

User security education and training is one of the most important aspects of an organizations security posture. Using security exercises to reinforce this aspect is frequently done by education and industry alike; however these exercises usually enlist willing participants. We have taken the concept of using an exercise and modified it in application to evaluate a users propensity to respond to email phishing attacks in an unannounced test. This paper describes the considerations in establishing and the process used to create and implement an evaluation of one aspect of our user information assurance education program. The evaluation takes the form of a exercise, where we send out a phishing styled email record the responses.

A video game for cyber security training and awareness

Although many of the concepts included in cyber security awareness training are universal, such training often must be tailored to address the policies and requirements of a particular organization. In addition, many forms of training fail because they are rote and do not require users to think about and apply security concepts. A flexible, highly interactive video game, CyberCIEGE, is described as a security awareness tool that can support organizational security training objectives while engaging typical users in an engaging security adventure. The game is now being successfully utilized for information assurance education and training by a variety of organizations. Preliminary results indicate the game can also be an effective addition to basic information awareness training programs for general computer users (e.g., annual awareness training.)

Meeting the criteria for a Center of Academic Excellence (CAE) in information assurance education

Information assurance is a critical topic in computer science curricula. Several publications in the educational literature address the development of curriculum and integration of information assu...

Education: Scholarship for Service

The US government created the scholarship for service (SFS) program to address the diminishing number of information assurance professionals it employs. In January 2000, an executive order defined the national plan for information systems protection, which outlined five federal cyber service training and education initiatives, including SFS. The next year, the national science foundation began awarding grants for student scholarships to universities that qualified as centers of academic excellence in information assurance education. In this article, the author outlines both SFS in general and New Mexico Institute of Mining and Technology's specific program

A Study Of Security Education In The Era Of Cyber-Terrorism

Cyber-Terrorism continues to confront the country with security threats. Since the September 11 attack, academia has not fully implemented in educational offerings a deterrence strategy satisfactory to the government. Though the National Security Agency has introduced Centers of Academic Excellence in Information Assurance Education, as an appropriate education program, there are only a small number of schools in the country that have enabled their offerings through this program. The focus of this study is to explore in survey the critical failure factors impacting the implementation of Centers of Academic Excellence education in academic institutions, by initially sampling schools in the Northeast Corridor of the United States. This study contributes to the discussion of important considerations for academic and governmental officials to further enable security strategy in this era of the cyber-terrorist.

Improving Information Assurance Education Key to Improving Secure(ity) Management

Improving Information Assurance Education Key to Improving Secure(ity) Management

Centers of academic excellence: a case study

The US National Security Agency's Centers of Academic Excellence (CAEs) in Information Assurance Education program is in its seventh year, and 59 educational institutions have received the coveted CAE designation. The program was originally designed to jump-start education of an information security workforce by providing incentives to academic institutions to form information assurance programs and to students by providing scholarships. It has since been augmented by scholarship programs from the US National Science Foundation and the US Department of Defense. Several hundred graduates from these scholarship programs are already in the federal workforce. Indeed, information security and assurance has quickly become an important topic in computer science departments worldwide, with increasing numbers of information security specialists earning associate, undergraduate, masters, and doctoral degrees in the subject

Back to school [security education

As summer draws to an end, faculty and students turn their attention to academic planning. This used to be a very tough task - faculty developed most of their materials from scratch. Now, rather than a handful of items to draw on when planning a security and privacy course, there is a plethora of sample syllabi, textbooks, and other supportive materials. The question is: where are they? For all the busy academics out there readying their courses, and the students who are about to join you, we have written the article, with help from the Centers of Excellence in Information Assurance Education, in the hope that it will make your preparations a trifle less hectic.

Educating leaders in information assurance

Information assurance is a new and rapidly evolving field. The best way to prepare professionals for the information age in light of the increasing security threat is not clear. There is an attempt to educate future leaders in information assurance at the undergraduate level. At this level, the authors found two distinct types of students and determined that their needs could be met only with separate courses. A course was developed for nontechnical majors that focuses on strategy and policy, but with a strong technical component. The course for computer science majors is highly technical, but does not neglect the strategy, policy, ethics, and laws of information warfare. In both courses, the authors have relied heavily on active learning activities, reducing the content, and focusing on teaching the students how to teach themselves. Each course culminated in a major project that required the students to demonstrate mastery of the course objectives. The accomplishment of course goals was extremely successful. These courses can be models for information assurance education at other undergraduate institutions.