Modern Aspects of Cyber-Security Training and Continuous Adaptation of Programmes to Trainees
Source abstract
Abstract
Nowadays, more-and-more cyber-security training is emerging as an essential process for the lifelong personnel education in organizations, especially for those which operate critical infrastructures. This is due to security breaches on popular services that become publicly known and raise people’s security awareness. Except from large organizations, small-to-medium enterprises and individuals need to keep their knowledge on the related topics up-to-date as a means to protect their business operation or to obtain professional skills. Therefore, the potential target-group may range from simple users, who require basic knowledge on the current threat landscape and how to operate the related defense mechanisms, to security experts, who require hands-on experience in responding to security incidents. This high diversity makes training and certification quite a challenging task. This study combines pedagogical practices and cyber-security modelling in an attempt to support dynamically adaptive training procedures. The training programme is initially tailored to the trainee’s needs, promoting the continuous adaptation to his/her performance afterwards. As the trainee accomplishes the basic evaluation tasks, the assessment starts involving more advanced features that demand a higher level of understanding. The overall method is integrated in a modern cyber-ranges platform, and a pilot training programme for smart shipping employees is presented.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Smart Grid Security and Resilience · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Foundation for Research and Technology–Hellas, Institute of Computer Science, Vassilika Vouton, 70013 Heraklion, Greece
Department of Electrical and Computer Engineering, Hellenic Mediterranean University (HMU), Estavromenos, 71410 Heraklion, Greece
Department of Electrical and Computer Engineering, Technical University of Crete, 73100 Chania, Greece
Innovation Department, Sphynx Technology Solutions AG, 6300 Zug, Switzerland
Research Centre for Adaptive Computing Systems (CeNACS), City, University of London, London EC1V 0HB, UK
Department of Computer Science, University of Milan, 20122 Milano, Italy
Innovation Department, Social Engineering Academy, 60322 Frankfurt, Germany
Research Department, SimPlan, 63452 Hanau, Germany
Research and Development Department, ITML, 11525 Athens GR, Greece
Applied Research Department, DANAOS Shipping Company, Limassol CY 3300, Cyprus
Systems Certification Department, TUV HELLAS (TUV NORD) SA, 15562 Athens GR, Greece
Research Department, ATOS SPAIN SA, 28037 Madrid, Spain
References (59)
Show source-provided references
1. A survey of Internet of Things: Architecture, enabling technologies, security and privacy, and applications10.1109/JIOT.2017.2683200 ↗
2. The Industrial Internet of Things as an enabler for a Circular Economy Hy-LP: A novel IIoT Protocol, evaluated on a Wind Park’s SDN/NFV-enabled 5G Industrial Network
3. Heimdall: Mitigating the Internet of Insecure Things10.1109/JIOT.2017.2704093 ↗
4. Hatzivasilis, G., Soultatos, O., Ioannidis, S., Verikoukis, C., Demetriou, G., and Tsatsoulis, C. (2019, January 30). Review of Security and Privacy for the Internet of Medical Things (IoMT). Proceedings of the 1st International Workshop on Smart Circular Economy (SmaCE), Santorini Island, Greece.10.1109/DCOSS.2019.00091 ↗
5. MobileTrust: Secure Knowledge Integration in VANETs10.1145/3364181 ↗
6. Khandelwal, S. (The Hacker News, 2015). United airlines hacked by sophisticated hacking group, The Hacker News.
7. Hirschfeld, J.D. (The New York Times, 2015). Hacking of government computers exposed 21.5 million people, The New York Times.
8. Santa, I. (2010). A Users’ Guide: How to Raise Information Security Awareness, ENISA.
9. Manifavas, C., Fysarakis, K., Rantos, K., and Hatzivasilis, G. (2014). DSAPE—Dynamic Security Awareness Program Evaluation. International Conference on Human Aspects of Information Security, Privacy, and Trust, Springer.10.1007/978-3-319-07620-1_23 ↗
10. Kish, D., and Carpenter, P. (2020, July 24). Forecast Snapshot: Security Awareness Computer-Based Training, Worldwide. Available online: https://www.gartner.com/en/documents/3629840/forecast-snapshot-security-awareness-computer-based-trai.
11. (2020, July 24). SANS: Online Cyber Security Training. Available online: https://www.sans.org/online-security-training/.
12. (2020, July 24). CYBERINTERNACADEMY: Complete Cybersecurity Course Review on Cyberinernacademy. Available online: https://www.cyberinternacademy.com/complete-cybersecurity-course-guide-review/.
13. (2020, July 24). StationX: Online Cyber Security & Hacking Courses. Available online: https://www.stationx.net/.
14. (2020, July 24). Cybrary: Develop Security Skills. Available online: https://www.cybrary.it/.
15. (2020, July 24). AwareGO: Security Awareness Training. Available online: https://www.awarego.com/.
16. (2020, July 24). BeOne Development: Security Awareness Training. Available online: https://www.beonedevelopment.com/en/security-awareness/.
17. (2020, July 24). ISACA: CyberSecurity Nexus (CSX) Training Platform. Available online: https://cybersecurity.isaca.org/csx-certifications/csx-training-platform.
18. (2020, July 24). Kaspersky: Kaspersky Security Awareness. Available online: https://www.kaspersky.com/enterprise-security/security-awareness.
19. (2020, July 24). CyberBit: Cyber Security Training Platform. Available online: https://www.cyberbit.com/blog/security-training/cyber-security-training-platform/.
20. Bloom, B. (1956). Taxonomy of educational objectives: The classification of educational goals. Handbook I: Cognitive Domain, David McKay Company.
21. Johnstone, M.N. (2010, January 30). Threat modelling with STRIDE and UML. Proceedings of the 8th Australian Information Security Management Conference (AISM), Perth Western, Australia.
22. Biggs, J. (2011). Teaching for Quality Learning at University: What the Student Does, Open University Press. [4th ed.].
23. R: Kolb’s Experiential Learning Theory: A Framework for Assessing Person-Job Interaction10.2307/257838 ↗
24. Othonas, S., Fysarakis, K., Spanoudakis, G., Koshutanski, H., Damiani, E., Beckers, K., Wortmann, D., Bravos, G., and Ioannidis, M. (2019, January 27). The TREAT-ARREST Cyber-Security Training Platform. Proceedings of the 1st Model-driven Simulation and Training Environments for Cybersecurity (MSTEC), Luxembourg.
25. Goeke, L., Quintanar, A., Beckers, K., and Pape, S. (2019, January 27). PROTECT—An Easy Configurable Serious Game to Train Employees Against Social Engineering Attacks. Proceedings of the 1st Model-Driven Simulation and Training Environments for Cybersecurity (MSTEC), Luxembourg.10.1007/978-3-030-42051-2_11 ↗
26. Beckers, K., Pape, S., and Fries, V. (2016, January 11–15). HATCH: Hack and trick capricious humans—A serious game on social engineering. Proceedings of the 30th International BCS Human Computer Interaction (HCI) Conference Fusion, Bournemouth, UK.10.14236/ewic/HCI2016.94 ↗
27. Braghin, C., Cimato, S., Damiani, E., Frati, F., Mauri, L., and Riccobene, E. (2019, January 27). A model driven approach for cyber security scenarios deployment. Proceedings of the 1st Model-Driven Simulation and Training Environments for Cybersecurity (MSTEC), Luxembourg.10.1007/978-3-030-42051-2_8 ↗
28. Somarakis, I., Smyrlis, M., Fysarakis, K., and Spanoudakis, G. (2019, January 27). Model-driven Cyber Range Training—The Cyber Security Assurance Perspective. Proceedings of the 1st Model-Driven Simulation and Training Environments for Cybersecurity (MSTEC), Luxembourg.10.1007/978-3-030-42051-2_12 ↗
29. Hautamäki, J., Karjalainen, M., Hämäläinen, T., and Häkkinen, P. (2019, January 11–13). Cyber security exercise: Literature review to pedagogical methodology. 13th annual International Technology. Proceedings of the Education and Development Conference, Valencia, Spain.10.21125/inted.2019.0985 ↗
30. McDaniel, L., Talvi, E., and Hay, B. (2016, January 5–8). Capture the Flag as Cyber Security Introduction. Proceedings of the 49th Hawaii International Conference on System Sciences (HICSS), Koloa, HI, USA.10.1109/HICSS.2016.677 ↗
31. Cybersecurity education: A holistic approach to teaching security
32. (2020, July 24). ISO 22398: Societal Security—Guidelines for Exercises. Available online: https://www.iso.org/standard/50294.html.
33. Pedagogical Approach to Effective Cybersecurity Teaching10.1007/978-3-662-59351-6_11 ↗
34. How can exploratory learning with games and simulations within the curriculum be most effectively evaluated?10.1016/j.compedu.2005.11.007 ↗
35. From classroom lessons to exploratory learning progressions: Mathematics + computational thinking10.1080/10494820.2019.1674879 ↗
36. Mann, L., Chang, R.L., Chandrasekaran, S., Coddington, A., Daniel, S., Cook, E., Crossin, E., Cosson, B., Turner, J., and Mazzurco, A. (2020). From problem-based learning to practice-based education: A framework for shaping future engineers. Eur. J. Eng. Educ., 1–21.10.1080/03043797.2019.1708867 ↗
37. Scheponik, T., Sherman, A.T., Delatte, D., Phatak, D., Oliva, L., Thompson, J., and Herman, G.L. (2016, January 12–15). How Students Reason about Cybersecurity Concepts. Proceedings of the Frontiers in Education Conference (FIE), Erie, PA, USA.10.1109/FIE.2016.7757363 ↗
38. Deliberate practice and acquisition of expert performance: A general overview10.1111/j.1553-2712.2008.00227.x ↗
39. The assessment of clinical skills/competence/performance10.1097/00001888-199009000-00045 ↗
40. Karjalainen, M., Kokkonen, T., and Puuska, S. (2019, January 17–19). Pedagogical Aspects of Cyber Security Exercises. Proceedings of the IEEE European Symposium on Security and Privacy Workshops, Stockholm, Sweden.10.1109/EuroSPW.2019.00018 ↗
41. Kick, J. (2020, July 24). Cyber Exercise Playbook. The MITRE Corporation. Available online: https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf.
42. Lif, P., Sommestad, T., and Granasen, D. (2018, January 11–12). Development and evaluation of information elements for simplified cyber-incident reports. Proceedings of the International Conference On Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA), Glasgow, UK.10.1109/CyberSA.2018.8551402 ↗
43. Said, S.E. (2018). Pedagogical Best Practices in Higher Education National Centers of Academic Excellence/Cyber Defense Centers of Academic Excellence in Cyber Defense. [Ph.D. Thesis, Union University].
44. Athauda, R., AlKhaldi, T., Pranata, I., Conway, D., Frank, C., Thorne, W., and Dean, R. (2018, January 3–6). Design of a Technology-Enhanced Pedagogical Framework for a Systems and Networking Administration course incorporating a Virtual Laboratory. Proceedings of the Frontiers in Education Conference (FIE), San Jose, CA, USA.10.1109/FIE.2018.8658837 ↗
45. Pohl, M. (2000). Learning to Think—Thinking to Learn: Models and Strategies to Develop a Classroom Culture of Thinking, Hawker Brownlow Education. [1st ed.].
46. Švábenský, V., Vykopal, J., Čermák, M., and Laštovička, M. (2018, January 2–4). Enhancing cybersecurity skills by creating serious games. Proceedings of the 23rd Annual ACM Conference on Innovation and Technology in Computer Science Education (ITiCSE), Larnaca, Cyprus.10.1145/3197091.3197123 ↗
47. Evaluation of Game-Based Learning in Cybersecurity Education for High School Students
48. Taylor-Jackson, J., McAlaney, J., Foster, J., Bello, A., Maurushat, A., and Dale, J. (2020, January 14). Incorporating Psychology into Cyber Security Education: A Pedagogical Approach. Proceedings of the AsiaUSEC’20, Financial Cryptography and Data Security (FC), Sabah, Malaysia.10.1007/978-3-030-54455-3_15 ↗
49. Moving Forward by Looking Backward: Embracing Pedagogical Principles to Develop an Innovative MSIS Program
50. Maintaining a Cybersecurity Curriculum: Professional Certifications as Valuable Guidance
51. Threat modelling methodologies: A survey
52. Anderson, L.W., Krathwohl, D.R., Airasian, P.W., Cruikshank, K.A., Mayer, R.E., Pintrich, P.R., Raths, J., and Wittrock, M.C. (2001). A Taxonomy for Learning, Teaching, and Assessing: A Revision of Bloom’s Taxonomy of Educational Objectives, Reference and Research Book News.
53. Bird, J., and Kim, F. (2014). Survey on application security programs and practices. A SANS Analyst Survey, SANS Institute.
54. (2020, July 24). DANAOS Shipping Company: DANAOSone Platform. DANAOS Management Consultants S.A. Available online: https://web2.danaos.gr/maritime-software-solutions/danaosone-platform/.
55. Trustwave (2016). Security Testing Practices and Priorities: An Osterman Research Survey Report, Osterman Research.
56. IMO (2004). SOLAS Chapter XI-2—International Ship and Port Facility Security Code (ISPS Code), International Maritime Organization (IMO).
57. (2020, July 24). CIS: Center of Internet Security. Available online: https://www.cisecurity.org/.
58. (2020, July 24). ESCO: Results of Simulation-Based Competence Development Survey. Available online: https://echonetwork.eu/report-results-of-simulation-based-competence-development-survey/.
59. Utilising Experiential and Organizational Learning Theories to Improve Human Performance in Cyber Training