An official website of the United States government
We conducted an observational study to document student misconceptions about cybersecurity using thematic analysis of 25 think-aloud interviews. By understanding patterns in student misconceptions, we provide a basis for developing rigorous evidence-based recommendations for improving teaching and assessment methods in cybersecurity and inform future research. This study is the first to explore student cognition and reasoning about cybersecurity. We interviewed students from three diverse institutions. During these interviews, students grappled with security scenarios designed to probe their understanding of cybersecurity, especially adversarial thinking. We analyzed student statements using a structured qualitative method, novice-led paired thematic analysis, to document patterns in student misconceptions and problematic reasoning that transcend institutions, scenarios, or demographics. Themes generated from this analysis describe a taxonomy of misconceptions but not their causes or remedies. Four themes emerged: overgeneralizations, conflated concepts, biases, and incorrect assumptions. Together, these themes reveal that students generally failed to grasp the complexity and subtlety of possible vulnerabilities, threats, risks, and mitigations, suggesting a need for instructional methods that engage students in reasoning about complex scenarios with an adversarial mindset. These findings can guide teachers’ attention during instruction and inform the development of cybersecurity assessment tools that enable cross-institutional assessments that measure the effectiveness of pedagogies.
more »
« less
How students reason about Cybersecurity concepts
Despite the documented need to train and educate more cybersecurity professionals, we have little rigorous evidence to inform educators on effective ways to engage, educate, or retain cybersecurity students. To begin addressing this gap in our knowledge, we are conducting a series of think-aloud interviews with cybersecurity students to study how students reason about core cybersecurity concepts. We have recruited these students from three diverse institutions: University of Maryland, Baltimore County, Prince George’s Community College, and Bowie State University. During these interviews, students grapple with security scenarios designed to probe student understanding of cybersecurity, especially adversarial thinking. We are analyzing student statements using a structured qualitative method, novice-led paired thematic analysis, to document student misconceptions and problematic reasonings. We intend to use these findings to develop Cybersecurity Assessment Tools that can help us assess the effectiveness of pedagogies. These findings can also inform the development of curricula, learning exercises, and other educational materials and policies.
more »
« less
- Award ID(s):
- 1819521
- PAR ID:
- 10110284
- Date Published:
- Journal Name:
- frontiers in education
- Page Range / eLocation ID:
- 1 to 5
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Artificial intelligence (AI) and cybersecurity are in-demand skills, but little is known about what factors influence computer science (CS) undergraduate students' decisions on whether to specialize in AI or cybersecurity and how these factors may differ between populations. In this study, we interviewed undergraduate CS majors about their perceptions of AI and cybersecurity. Qualitative analyses of these interviews show that students have narrow beliefs about what kind of work AI and cybersecurity entail, the kinds of people who work in these fields, and the potential societal impact AI and cybersecurity may have. Specifically, students tended to believe that all work in AI requires math and training models, while cybersecurity consists of low-level programming; that innately smart people work in both fields; that working in AI comes with ethical concerns; and that cybersecurity skills are important in contemporary society. Some of these perceptions reinforce existing stereotypes about computing and may disproportionately affect the participation of students from groups historically underrepresented in computing. Our key contribution is identifying beliefs that students expressed about AI and cybersecurity that may affect their interest in pursuing the two fields and may, therefore, inform efforts to expand students' views of AI and cybersecurity. Expanding student perceptions of AI and cybersecurity may help correct misconceptions and challenge narrow definitions, which in turn can encourage participation in these fields from all students.more » « less
-
null (Ed.)With children spending more time online, personal data are stored on their devices making them susceptible to online risks. Exposing students to cybersecurity education at an early age is critical for raising awareness and knowledge. Yet access to cybersecurity education curricular materials that are engaging for young students is limited. In this work, we present interactive cybersecurity stories for students in grades 3-5 delivered through a commercial social robot. Through focus groups and interviews we subsequently investigated teachers’ views on using a social robot for cybersecurity education, interest in incorporating social robots in the classroom, and perceptions of the ways in which social robots can impact teaching practice and student learning. Findings indicated that teachers found the social robot engaging and expressed interest in using it in their classroom despite some concerns. Findings have implications for the design and implementation of cybersecurity curricula delivered through emerging technologies.more » « less
-
Recognizing the value of engagement in learning, recent engineering education initiatives have worked to encourage all types of students to pursue engineering while also facilitating the construction of makerspaces on university campuses. Makerspaces have the potential to engage a broader range of students by providing unique and personalized pathways into engineering. While this aims to improve the quality of an engineer’s education, the reality settles in when we begin to question whether these makerspaces are, in fact, encouraging learning in engineering for all types of students. In this work, we focus on investigating how a university makerspace affords learning for female students. We implemented an in-depth phenomenologically based interviewing approach which involved a series of three 90-minute semi-structured interviews with six highly engaged female undergraduate students involved in different makerspaces at a single university. The purpose of these interviews was to engage the students in their experiences with the makerspaces and the projects that they work on in this space, so as to inform how these spaces afford learning, specifically the impact on female student learning. All interviews were conducted by the same female graduate student. This work focuses on the second interviews of two females who had student worker roles in their respective makerspaces on campus. All of the interviews for these two females were transcribed resulting in 180 pages of single-spaced transcriptions, and the second interviews were analyzed through two phases of qualitative data analysis. Types of learning emerged in multiple forms and are presented via case studies of each female participant. For case one, these types of learning include machines learning, social learning, design learning, and self-learning. In the second case, the types of learning are tool learning, resourceful learning, space learning, and management learning. These types of learning are then further discussed according to engineering education pedagogy and implications. Makerspaces are often labeled as “open, learning environments,” and this work demonstrates how these spaces facilitate unique forms of learning that engage these women in the makerspace.more » « less
-
Paiva, A.C.R.; Cavalli, A.R.; Ventura, Martins P.; Perez-Castillo, R. (Ed.)The ubiquitous use of software in critical systems necessitates integrating cybersecurity concepts into the software engineering curriculum so that students studying software engineering have adequate knowledge to securely develop software projects, which could potentially secure critical systems. An experience report of developing and conducting a course can help educators to gain an understanding of student preferences on topics related to secure software development. We provide an experience report related to the ‘Secure Software Development’ course conducted at Tennessee Technological University. We discuss student motivations, as well as positive and negative perceptions of students towards exercises. Based on our findings, we recommend educators to integrate real-world exercises into a secure software development course with careful consideration of tool documentation, balance in exercise diversity, and student background.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- https://doi.org/10.1109/FIE.2016.7757363
