Cybersecurity Training Research Articles

Capability Assessment Methodology and Comparative Analysis of Cybersecurity Training Platforms

Cybersecurity training is a key endeavour for ensuring that the IT workforce possess the knowledge and practical skills required to counter the ever-increasing cybersecurity threats that our society is faced with. While some related systems, such as Capture The Flag platforms, have been available for almost one decade, platforms that support full-fledged cybersecurity training exercises have only been released as open source in recent years. Given the complexity of such cybersecurity training platforms, the question that arises is how to meaningfully evaluate and compare their capabilities in order to identify the most suitable solution for a given type of organization and/or training activity. In this paper, we introduce a capability assessment methodology for cybersecurity training platforms that focuses on the three key aspects of training: content representation, environment management, and training facilitation. The assessment tool that we developed is used to evaluate two open-source cybersecurity training platforms, CyTrONE and KYPO. We then conduct a comparative analysis of these two platforms based on our first-hand developer experience with them, and discuss the lessons learned from implementing, deploying and using these platforms. The assessment tool and the detailed technical comparative analysis that we conducted are intended as instruments and references for anyone who plans to deploy or develop cybersecurity training platforms.

Indicators of employee phishing email behaviours: Intuition, elaboration, attention, and email typology

Employees’ behaviour to phishing emails can strengthen or undermine business organisations’ cyber security. This phishing simulation and survey study explored the relationship between sociodemographic, cyber security training, phishing email typology and information processing factors and risky and secure email response behaviours. Participants (N = 590) were employees of a large financial institution who received one of four types of phishing emails. Participants who engaged in risky cyber email behaviour clicked on the link in the phishing email whereas those who engaged in secure cyber email behaviour reported the email to the institutions cyber security team. Our findings show that the likelihood of clicking on a link in a phishing email was lower for participants who had greater faith in their intuition and paid more attention to the sender's email address. The likelihood of clicking on a link in a phishing email was greater for participants who received the ‘Undelivered package’ email relative to the ‘Received PDF’. The likelihood of reporting a phishing email was greater for participants who engaged in greater elaborative processing to evaluate the email than those who used less elaboration. Theoretical and practical implications as well as future directions are discussed.

Authentic learning environments for in-service training in cybersecurity: a qualitative study

Authentic learning environments for in-service training in cybersecurity: a qualitative study

Factor Analysis of Learning Motivation Difference on Cybersecurity Training With Zero Trust Architecture

Factor Analysis of Learning Motivation Difference on Cybersecurity Training With Zero Trust Architecture

Hands-on training in industrial cybersecurity for a multidisciplinary Master's degree

As a response to the scarcity of workforce with essential competences for Industry 4.0, academic institutions are making an effort to propose specialized educational programs. In this context of digitalization, industrial cybersecurity is an increasingly important aspect. Nevertheless, industrial cybersecurity is a challenging topic that requires the understanding of both information technologies and the operation of industrial facilities. Furthermore, practical training requires realistic environments to be useful. For this reason, in this work, we present a hands-on activity on a remotely accessible training platform to complement the theoretical concepts of a Master's degree course that deals with the introduction to industrial cybersecurity. This platform presents the students a realistic automation environment with industrial hardware and software. The educational experience has been assessed with regard to the students’ perception and its technical operation. The platform was found useful for learning and motivating, although the perceived degree of difficulty needs to be adjust to promote students’ self-confidence.

A Cybersecurity Training Concept for Cyber-physical Manufacturing Systems

Networked manufacturing systems based on traditional Industrial Control Systems (ICS) are particularly exposed to cyberattacks. Mostly based on Programmable Logic Controllers (PLCs), they have been designed to isolate manufacturing environments without connection to cyber-infrastructures such as cloud, connectivity with offices, and other manufacturing sites. Hence, low cybersecurity protection levels make such ICS interesting for malicious cyber-attackers. Thus, resilience to such attacks through cybersecurity has become one of the most significant concerns of Industry 4.0. While the technical aspects of cybersecurity for manufacturing systems are increasingly researched, there are few published works on effective methods to train cybersecurity for manufacturing systems. This paper proposes a cybersecurity training concept that builds on teaching cybersecurity in an interactive role-based approach within a teaching factory environment. Both attack and defense strategies can be explored, and student learning performance evaluated. The concept has been implemented to show its feasibility and potential to outperform traditional classroom-based training methods.

Automatic Detection of Java Cryptographic API Misuses: Are We There Yet?

The Java platform provides various cryptographic APIs to facilitate secure coding. However, correctly using these APIs is challenging for developers who lack cybersecurity training. Prior work shows that many developers misused APIs and consequently introduced vulnerabilities into their software. To eliminate such vulnerabilities, people created tools to detect and/or fix cryptographic API misuses. However, it is still unknown (1) how current tools are designed to detect cryptographic API misuses, (2) how effectively the tools work to locate API misuses, and (3) how developers perceive the usefulness of tools’ outputs. For this paper, we conducted an empirical study to investigate the research questions mentioned above. Specifically, we first conducted a literature survey on existing tools and compared their approach design from different angles. Then we applied six of the tools to three popularly used benchmarks to measure tools’ effectiveness of API-misuse detection. Next, we applied the tools to 200 Apache projects and sent 57 vulnerability reports to developers for their feedback. Our study revealed interesting phenomena. For instance, none of the six tools was found universally better than the others; however, CogniCrypt, CogniGuard, and Xanitizer outperformed SonarQube. More developers rejected tools’ reports than those who accepted reports (30 versus 9) due to their concerns on tools’ capabilities, the correctness of suggested fixes, and the exploitability of reported issues. This study reveals a significant gap between the state-of-the-art tools and developers’ expectations; it sheds light on future research in vulnerability detection.

COMPARATIVE ANALYSIS OF STRATEGIES FOR BUILDING SECOND AND THIRD LEVEL OF 125 “CYBER SECURITY” EDUCATIONAL PROGRAMS

The article analyzes the global market for the provision of educational services in the field of information security and cybersecurity. The study aims to compare strategies for building curricula for the second and third levels of education for specialties related to information technology, information, and cybersecurity, as well as to formulate recommendations for harmonizing the learning process and international standards. Cybersecurity training programs are becoming outdated too quickly. ISO standards are updated approximately every four years. Also, the standard for the specialty 125 “Cybersecurity” for the third educational level still needs to be finalized. There is a problem of forming a consistent process of introducing the latest approaches and practices into the curriculum. The growth of the information technology market is leading to an increase in the need for cybersecurity specialists. Two processes are taking place simultaneously: the transition from practical skills to fundamental knowledge and vice versa. The most successful higher education institutions are those that can combine both approaches simultaneously. But this requires an experimental base, practical training laboratories, and a staff of teachers and researchers. Only large institutions can perform this task. Since cybersecurity challenges are constantly changing, higher education institutions are required to improve their programs annually. Simultaneously with the process of updating teaching approaches, the body of international and industry standards, as well as various best practices and frameworks, are being improved. Rapid change requires not only continuous improvement from educators but also from cybersecurity practitioners. Thus, the process of continuous learning should continue after the formal completion of a master's or Ph.D. program. The results of this study show that only a comprehensive development of information security skills allows for high-quality training of specialists. Based on this, the requirements for the educational standard for training specialists and scientists are presented.

Mandatory Gamified Security Awareness Training Impacts on Texas Public Middle School Students: A Qualitative Study

Aim/Purpose. The problem statement in the proposed study focuses on that, despite the growing recognition that teenagers need to undergo security awareness training, little is known about the impacts security training experts believe implementing a mandatory gamified security awareness training curriculum in public middle schools will have on the long-term security behavior of students in Texas. Background. This study was guided by the research question: What are the impacts security training experts believe implementing a mandatory gamified security aware-ness training curriculum in public middle schools will have on the long-term security behaviors of students in Texas? The study gathers opinions from experts on the impacts of security awareness training on students. Methodology. Our research used semi-structured interviews with twelve experts chosen through the use of purposive sampling. The population for the study consisted of experts in the fields of security awareness training for and teaching middle school-aged children. Candidates were recruited through the Cyber-Texas Foundation and snowball sampling techniques. Contribution. The research contributed to the body of knowledge by using interviews to explore the impacts of security awareness training on middle school students based on the opinions and views of the teachers and instructors who work with middle school students. Findings. The findings of this study demonstrate that middle school is an ideal time to provide cybersecurity training and will impact student behaviors by making them more conscious of cyber threats and preparing them to be more tech-savvy professionals. The research also showed that well-designed cybersecurity games with real-world application combined with traditional teaching techniques can help students develop positive habits. The research also suggests that teachers possess the skills to teach cybersecurity classes and the classes can be integrated into the current school day without the need for any significant changes to existing daily schedules. Recommendations for Practitioners. A well-design gamification-based curriculum implemented in Texas Middle Schools, combined with traditional teaching techniques and repeated over an extended time period, will impact students’ behaviors by making them more able to recognize and respond to cyber risks and will transform them into more secure and tech-savvy members of society. Recommendations for Researchers. The research shows middle school instructors and technology experts believe the implementation of a security awareness training program in middle schools is both possible and practical, while also beneficial to the students. The recommendation is to encourage researchers to explore ways to build curricula and games capable of appealing to students and implementing the instruction into school programs. Impact on Society. Demonstrating that training provided in middle school will make lasting impacts and improvements to student behaviors benefits children and their families in the short-term and workplaces in the long-term. The development of a more security-conscious workforce can reduce the significant number of data breaches and cyber attacks resulting from the poor security habits of companies’ users. Future Research. Future research that will add significant value to the body of knowledge includes testing the effectiveness of habit-shaping games to determine whether existing long-term games maintain student interest. Qualitative studies could interview parents of teenagers using habit-shaping games to determine the effectiveness of the applications. Another qualitative study could interview teachers to determine how teachers’ ages affect their comfort level teaching technology classes. Both studies could provide valuable insights into how to implement security awareness training in schools.

Importance of Cybersecurity in The Higher Education Sector 2022

Today, we are witnessing the widespread of the digital revolution and its applications in all fields, as the means of networking provided the exchange of information, experiences, and knowledge in all sectors, but with all these positive features, we find that today’s digital world has brought a wide range of risks of its own, such as attacks and malicious programs like viruses, worms, spyware files, etc. and the education sector higher education is not far from these negative influences that hinder the education process and affect its infrastructure and its periphery, including students, teachers, administrative assistants, the environment and teaching methods. For this risk, we need to awareness and cyber security training and adopt a solid cyber security policy in higher education sectors institution in order to protect this vital sector. This research paper will explore the importance of cybersecurity in this sector and provide the strategies that students, faculty, and staff can utilize to promote cybersecurity across higher education institutions.

Evaluating protection motivation based cybersecurity awareness training on Kirkpatrick's Model

ContextCybersecurity behavioral literature has a significant number of studies on training and awareness. However, there is lack of theoretical underpinnings in developing intervention to allow for positive behavioral change and evaluating them. The evaluation of theory based cybersecurity training warrants the use of program evaluation techniques. ObjectiveThe protection motivation theory (PMT) was employed to understand the behavioral change after the implementation of cybersecurity training. The evaluation was done on three levels of Kirkpatrick's evaluation model – reaction, learning and behavior. MethodA pre-post quasi experimental design was adopted in this research. A total of 154 undergraduate students from computing and digital arts backgrounds took part in the research. ResultsThe results of the study showed that the PMT based training was effective in increasing the threat knowledge of the students along with the increase in information of countermeasure strategies. From the two components of the PMT, self-efficacy was found to be the significant predictor of the cybersecurity behavioral intention in both pre-test and post-test PMT models. The cybersecurity training increased the self-efficacy of the students significantly and contributed towards cybersecurity behavioral intention change. The findings of this study imply that in designing the cybersecurity trainings, educators should dominantly take into account the self-efficacy component of the PMT.

Assessing the Relevance of Cybersecurity Training and Policies to Prevent and Mitigate the Impact of Phishing Attacks

Assessing the Relevance of Cybersecurity Training and Policies to Prevent and Mitigate the Impact of Phishing Attacks

Pwnable-Sherpa: An interactive coaching system with a case study of pwnable challenges

To improve their cybersecurity knowledge and skills, students participate in a competitive game called capture the flag (CTF). CTF is used as an educational tool to improve students’ cybersecurity competency by solving challenges. As system vulnerabilities are the leading cause of cyberattacks on critical systems, cybersecurity personnel with knowledge and skills to detect system vulnerabilities are increasingly in demand. In this context, the importance of challenges concerning system vulnerabilities, such as pwnable, is gradually increasing in CTF competitions. Unlike other CTF challenges, solving a pwnable challenge requires considerable knowledge and skill. However, traditional evaluation methods in CTF (i.e., pass or non-pass) provide limited feedback regarding knowledge and skill gaps. To investigate this issue, we analyzed the results of the CTF competitions held by our research team over the past three years (2017, 2018, and 2020). Our analysis revealed the necessity for a new evaluation system that can provide detailed feedback to students, while reducing the grading burden on educators. Thus, to provide detailed feedback, we propose a cybersecurity training platform, Pwnable-Sherpa, which sets three detailed evaluation points for a given pwnable challenge. In addition, we designed our training platform with a multi-container architecture and an LLVM dummy pass, thereby saving time by grading each detailed assessment simultaneously rather than sequentially.

Gamification in Cybersecurity Education: The RAD-SIM Framework for Effective Learning

The effectiveness of gamification in educational technology and digital learning environments has been the subject of research for over a decade. Gamified interventions encourage active learning by promoting role-playing, mentalisation, and experimentation. Learner-centred approaches have been shown to increase learning outcomes compared to traditional methods in some domains. Although the behavioural drivers associated with gamified learning are now well documented, practical advice for game designers who produce workplace training is much less common. This paper proposes the RAD-SIM framework for behaviourally effective cybersecurity games design, whereby psychological and behavioural principles are combined with learning theories to facilitate practical game-based learning. Using the framework will increase the engagement and retention of knowledge of the end-user. Although designed with cybersecurity training in mind, there are implications for educational game design in general. Future avenues for research, including potential case studies in practice, increasing the customisability of gamified interventions, and utilising natural data from organisations are considered. Social Machines conducted this work funded by the Research Institute for Sociotechnical Cyber Security (RISCS).

Moving beyond cyber security awareness and training to engendering security knowledge sharing

Employees play a critical role in improving workplace cyber security, which builds on widespread security knowledge and expertise. To maximise knowledge levels, organisations run awareness and training course. Yet, they should also encourage and facilitate Security Knowledge Sharing (SKS). To facilitate such sharing, we used a bespoke App which deploys a game to deliver security training and to encourage sharing based on the Transactive Memory System (TMS) theory. An empirical study was conducted within a Saudi Arabian Fortune 100 organisation to test the impact of the app on employee knowledge. The app demonstrated efficacy in enhancing organisational security awareness and knowledge. The results highlight the potential of TMS in improving overall security knowledge in organisations.

MITRE att&ck TM based language for effective training in cyber range

Cyber security exercises and training are critical in ensuring that the people protecting systems have the necessary abilities. For this purpose, cyber range is a significant instrument used to educate security professionals, since it provides threat simulation and training material for adversary attack scenarios. However, the majority of current threat scenario generation takes time and results in static scenarios that are both inefficient and unrealistic. We propose the “MITRE ATT&CKTM Based Language (MABL)” which will streamline the cyber range functions by assimilating and portraying knowledge on attack procedures. The proposed language will give information about attack techniques and be dynamic in nature.

Cybersecurity threats in agriculture supply chains: A comprehensive review

Agriculture supply chains, vital to global food security and economic stability, are increasingly integrating advanced technologies such as the Internet of Things (IoT), precision agriculture, and blockchain to enhance efficiency and transparency. However, this digital transformation exposes these supply chains to significant cybersecurity threats. This comprehensive review explores the various cybersecurity threats faced by agriculture supply chains, including malware and ransomware attacks, phishing and social engineering, data breaches, IoT vulnerabilities, and supply chain attacks. Through case studies and analysis, the review highlights the economic, operational, and reputational impacts of these threats, underscoring the potential for substantial financial losses, disruption of supply chain processes, and erosion of consumer trust. The review identifies several vulnerabilities within agriculture supply chains, such as technological weaknesses in IoT devices, inadequate encryption, lack of cybersecurity awareness among personnel, and reliance on legacy systems. Addressing these vulnerabilities is crucial for maintaining the integrity and resilience of agriculture supply chains. The review discusses various mitigation strategies and best practices, including the implementation of robust cybersecurity measures, regular updates and patch management, the use of advanced technologies like AI and machine learning for threat detection, and comprehensive cybersecurity training programs. Additionally, the review emphasizes the importance of policy and regulatory measures, advocating for the development and enforcement of cybersecurity standards and enhanced collaboration between government and private sectors. Looking towards the future, the review explores emerging trends and advancements in cybersecurity technologies, anticipated regulatory changes, and the necessity of continuous monitoring and adaptive strategies to address evolving threats. This review highlights the critical need for proactive cybersecurity measures in agriculture supply chains, encouraging stakeholders to prioritize cybersecurity to safeguard the sector's sustainability and resilience in an increasingly digitalized world.

Why people keep falling for phishing scams: The effects of time pressure and deception cues on the detection of phishing emails

Lack of personalisation and poor mechanics (e.g., grammar, spelling and punctuation) are commonly cited as cues of deception that people can use to identify phishing emails. However, in an online email classification experiment (N = 472), we found no empirical evidence that the presence of these features was associated with better phishing email discrimination. We also manipulated time pressure and found that it significantly reduced detection accuracy. Participants rarely inspected the URLs associated with links in the phishing emails but, when they did, their detection performance improved. Better performance in distinguishing between genuine and phishing emails was linked to lower levels of an intuitive decision-making style and relatively lower education levels amongst a highly educated sample. Older participants and those with greater computer proficiency and stronger email habit showed a slight increase in tendency to judge emails as suspicious. The results are discussed in terms of intervention strategies such as cyber security training to improve resilience to phishing attacks.

Determination of Cyber Security Issues and Awareness Training for University Students

In this study, it is aimed to determine the cyber security problems and awareness training to university students. The research was carried out in the fall semester of 2021–2022. The study, which was carried out with the participation of 410 university education and psychology students, was carried out using the survey model. In the research, 4-week cyber security and cyberattack training was given online to university students. The cyber security measurement tool was developed and used by the researchers in order to collect data in the study. The data collection tool used in the research was delivered and collected by the online method. The analysis of the data was made using the SPSS programme, frequency analysis and t-test. The results were added to the research in the form of tables. As a result of the research, it was concluded that university cyber security and cyberattack training was designed and they were good in this field.
 

Use of cyber attack and defense agents in cyber ranges: A case study

With the ever-changing cybersecurity landscape, the need for a continuous training for new cybersecurity skill sets is a requirement. Such continuous training programs can be delivered on platforms like cyber ranges. Cyber ranges support training by providing a simulated or emulated representation of a computer network infrastructure, besides additional training and testing services. Cyber attack and defense skills can be gained by attacking and defending a simulated or an emulated infrastructure. However, to provide a realistic training in such infrastructures, there is a need for necessary friction in the environment. Human teams, playing both attackers’ and defenders’ roles, provide this friction. Involving human teams in large-scale cybersecurity exercises is relatively inefficient and not feasible for standardizing training because different teams apply different tactics. Currently, the proposed solutions for cyber range training platforms focus on automating the deployment of the cybersecurity exercise infrastructure but not on the execution part. This leaves a room for improving exercise execution by adding realism and efficiency. This research presents an agent-based system that emulates cyber attack and defense actions during cybersecurity exercise execution; this helps provide realistic and efficient cybersecurity training. To specify agents’ behavior and decision making, a new formal model, called the execution plan (EP), was developed and utilized in this work.