1 of 34

From Classroom to Contest: Equipping Teachers and Training Students for Cybersecurity Competitions

Dr. David Zeichick

Computer Science Department

California State University, Chico

2 of 34

Contents

  • Industry’s take on cybersecurity graduates' preparedness
  • Students’ perception on succeeding in the industry
  • Learning theories and Cybersecurity education and competitions in curriculum
  • Overview of competitions and researched benefits
  • Survey Results
  • Resources to get started

​

​

​

3 of 34

David Zeichick

  • Commissioner of the National Cyber League
  • Co-chair of the NIST NICE Cybersecurity Skills Competitions Community of Interest
  • Assistant Professor in the department of Computer Science at Chico State, California

4 of 34

Impact of security breaches

  • 44-50% of small businesses have been the victim of cyberattacks (Raineri, 2019)
    • Costing nearly $9k
    • 90% of don’t have a technology focused IT manager
    • 68% don’t provide any form of cybersecurity training for their employees
    • 83% don’t even have basic cybersecurity practices implemented
      • such as automatic systems to require employees to periodically change passwords
  • Cyber-attacks' complexity and impact demand skilled experts with scientific and practical knowledge to safeguard national security and combat cybercrimes (Mostafa, 2019)

It’s bad

5 of 34

lack of talent

  • The skills gap is the biggest problem in cybersecurity (John et al., 2020)
  • The cybersecurity workforce must expand by 145% to meet market demands (ISC, 2019)
  • The rapid growth and technical complexity of cyberattacks are exacerbating the gap between the increasing demand for cybersecurity professionals and the shortage of relevant security skills (Mouheb et al., 2019)
  • If left unaddressed, the shortage will persist and worsen, as the demand for cybersecurity talent continues to outpace the available supply (Williams et al., 2021)�

Must expand by 145% to meet market demands

6 of 34

7 of 34

Why lack of talent?

  • the training methods students receive (John et al., 2020)
    • Current cyber training environments do not accurately mirror real-world cyber situations (Mouheb et al., 2019)
  • the inadequacies in the education process
    • which hinder the attainment of reliable and well-prepared cybersecurity professionals (John et al., 2020)
  • perception of what skills are essential differ between employers, educational leaders, and employees (Jang, 2015),

Current cyber training environments do not accurately mirror real-world cyber situations

8 of 34

Industry’s take on graduates' preparedness

  • The DHS CyberSkills Report highlights a common industry critique of higher education programs
    • graduates lack practical, hands-on skills in cybersecurity (DHS Task Force on CyberSkills, 2012)
    • There exists a disconnect between the skills acquired through educational programs and the practical, transferable skills essential for the workplace as a whole(Sarkar et al., 2016)
  • Students are typically not offered the pathways to attain the cybersecurity expertise in demand by the market (Sigholm et al., 2019)
  • Many studies indicate that teamwork and communication are crucial skills, yet recent graduates often lack proficiency in these areas. [Passow, 2012]
  • These gaps primarily revolve around practical, hands-on, and in-depth technical skills (Williams et al., 2021)�

​

graduates lack practical, hands-on skills in cybersecurity (DHS Task Force on CyberSkills, 2012)

9 of 34

Students’ perception of their ability to succeed

​

  • Self-Efficacy in STEM Majors
    • Self-efficacy is an individual's perception of their own ability to successfully complete a task (Bandura, 1994)
    • Self-efficacy beliefs in undergraduate STEM students have been correlated with success and persistence in these fields [Zeldin, 2000]
    • Research has demonstrated that self-efficacy beliefs significantly influence the interest, expectations, satisfaction, and choices of engineering students (Lent et al.,2008), (Hutchison, 2006), (DeWitz, 2002)
    • Self-efficacy has a noteworthy impact not only on student performance but also on their career choices (Sandler, 2000)
      • students who possess confidence in their career choices tend to exhibit higher levels of persistence (Srsic, 2001)
  • Fostering Career Efficacy in Introductory Courses
    • Effective introductory courses should promote career efficacy, empowering students to be confident in their abilities for success (Bratosin, 2014)

Self-efficacy has a noteworthy impact not only on student performance but also on their career choices

Intro classes should help promote this

10 of 34

Learning theories

  • Active Engagement and Collaboration
    • Research in pedagogy has consistently demonstrated that students achieve optimal performance when actively engaged in their tasks (Machado, 2009)
      • working collaboratively
      • engaging in discussions
      • sharing ideas
    • It is vial to integrate hands-on exercises in the classroom immediately after covering the theoretical aspects of a topic (Lukowiak, 2014)
  • Continuous Learning Approach (Sessa and London, 2015)
    • Sessa and London (2015) propose a continuous learning approach, which can be viewed from two perspectives:
      • a) Learners should seek out new experiences and challenges.
      • b) Learners should explore familiar concepts in innovative ways.�
  • Students achieve optimal performance when actively engaged in their tasks
  • Students should explore familiar concepts in innovative ways allowing them to abstract and generalize concepts

11 of 34

Learning theories continued

  • Challenge-Based Learning (CBL) (O’Neill and O’Neill, 2005)
    • are employed in student-centered approaches
    • In these approaches, learners are encouraged to
      • leverage their prior knowledge
      • acquire new insights
      • collaborate as a team
      • apply their creativity to develop solutions within the context of active learning exercises�

In Challenge-Based Learning students apply their creativity to develop solutions within the context of active learning exercises

12 of 34

Hands-on Learning!

  • Computer science students tend to favor hands-on, physical activities as a means of learning, over traditional lectures or reading from books (Kalnishkan, 2005)
  • Hands-on computing exercises have proven to be an extremely effective approach for teaching and learning cybersecurity (Chisholm, 2015)
  • The integration of hands-on and practical cybersecurity instruction is recognized as a vital component in the effort to modernize engineering education, as acknowledged by ABET (Passow, 2012)
  • Transformative Impact of Laboratory-Based Engineering Course (Hoit et al., 1998)
    • Converting a lecture-based general engineering introductory course to a hands-on laboratory format for various engineering disciplines resulted in substantial improvements in engineering retention
    • This was measured by the higher number of students remaining in engineering at the beginning of the third year, following the course restructuring.�

Hands-on computing exercises have proven to be an extremely effective approach for teaching and learning cybersecurity

13 of 34

The National Cybersecurity Workforce Framework (NCWF)

  • Created by NIST’s National Initiative for Cybersecurity Education (NICE)
  • are the categories and skill sets that should be considered in the cybersecurity field (Newhouse et al., 2017)
  • Comprises 31 specialty areas organized into seven categories
    • each specialty area has a list of
      • typical tasks
      • knowledges, skills, and abilities (KSAs)
      • competency areas
  • This mapping process assists in the development of educational programs, teaching materials, and the formulation of appropriate learning goals and objectives in the field of cybersecurity (Katsantonis et al., 2017)

This mapping process assists in the development of educational programs, teaching materials, and the formulation of appropriate learning goals and objectives in the field of cybersecurity

14 of 34

“educating a cybersecurity professional is similar to training a pilot, an athlete or a doctor. Time spent on the task for which the person is being prepared is critical for success.”�- Daniel Manson and Ronald Pike

15 of 34

Competitions Pedagogical Benefits

  • actively engage learners (Chothia and Novakovic , 2015, Conte de Leon, et al., 2019)
  • opportunities to practice and refine critical cyber-skills with practical, hands-on experiences (Katsantonis et al., 2017, Conte de Leon, et al., 2019, John et al., 2020)
    • Teaches how to analyze complex cases, envision solutions, swiftly respond to incidents, and execute precise commands and actions in various scenarios (Allen and Straub, 2015)
  • Increased motivation to learn about cybersecurity (Cheung et al. 2012, Bashir et al., 2015, Vigna et al., 2014, Mirkovic and Peterson, 2014, Davis et al., 2014, Malone et al., 2021, Zan 2022))
    • 61% of participants were more persuaded to enter a career in cyber security after the competition (Bashir et al., 2015)
    • 80% of high school students said that they were more likely to purse cybersecurity after the competition (Bashir et al., 2015)

​

opportunities to practice and refine critical cyber-skills with practical, hands-on experiences

Increased motivation to learn about cybersecurity

16 of 34

Competitions Pedagogical Benefits continued

  • The enjoyment and satisfaction of competing (Vigna et al., 2014, Mirkovic and Peterson, 2014, Davis et al., 2014, Muntean, 2011)
  • Increased perceived learning outcomes (Malone et al, 2021)
  • ”made me a better cybersecurity professional”
    • On a scale of 1 to 5, the average response was 4.35 (Gavas et al., 2012)
  • Forms the “security mindset” (Dark, 2014)
  • Industries derive significant advantages from cybersecurity competitions, as these events serve as platforms for professional networking and scouting young talent (Gavas et al. 2012, Mouheb et al., 2019)
  • foster teamwork and cooperation by requiring students to collaborate effectively as a group (Gotel et al., 2009)

foster teamwork and cooperation by requiring students to collaborate effectively as a group

17 of 34

18 of 34

Competition Concerns

  • Competing in these contests requires a substantial knowledge base (Cheung et al., 2012)
  • In many cases, competitions do not provide training opportunities for participants (Mouheb et al., 2019)
  • Typically have a narrow focus, and they may not adequately encompass a diverse range of topics, limiting participants' exposure to different aspects of the subject matter (Katsantonis et al., 2017)

​

​

19 of 34

20 of 34

21 of 34

22 of 34

TOP INDIVIDUAL | EXPERIENCED LEADERBOARD

1st Place

Andrew Effenhauser�San Jacinto College

Point value: 2900�Accuracy: 92.20%

23 of 34

Let’s Ask Past Competitors

  • 60 NCL alumni now working in cybersecurity were contacted over LinkedIn
    • 34 completed the survey ( more than a 55% response rate)
  • 6,013 NCL alumni that recently graduated were emailed a link to the survey
    • 47 completed the survey (just a .8% response rate)

​

24 of 34

To what extent did the NCL impact your motivation to learn more about cybersecurity, either positively or negatively?

Mean = 4.66

Standard Deviation = 0.62

25 of 34

To what extent did the NCL influence your understanding of cybersecurity, either positively or negatively?

Mean = 4.49

Standard Deviation = 0.66

26 of 34

The NCL provided hands-on experience that was not available in my formal education or training.

Mean = 4.22

Standard Deviation = 0.86

27 of 34

To what extent did the NCL affect your confidence in the cybersecurity field, either positively or negatively?

Mean = 4.22

Standard Deviation = 0.83

28 of 34

Q12: During your job interviews, was the NCL discussed?

Powered by

29 of 34

  • interviewees brought up the NCL as a topic of conversation, emphasizing their rankings and the technical proficiency they gained through participation.
  • NCL discussions served as evidence of knowledge, passion, and engagement with cybersecurity, compensating for a lack of prior work experience for some candidates.

During your job interviews, was the NCL discussed?

30 of 34

Resources

​

31 of 34

LIST OF CYBERSECURITY COMPETITIONS

cyberchallengecentral.com

32 of 34

Works cited

  • Raineri, Ellen M., and Tamara Fudge. “Exploring the Sufficiency of Undergraduate Students’ Cybersecurity Knowledge Within Top Universities’ Entrepreneurship Programs.” Journal of Higher Education Theory & Practice 19, no. 4 (2019). http://www.digitalcommons.www.na-businesspress.com/JHETP/JHETP19-4/7_RaineriEM_19_4_.pdf.
  • Allen, P. D., and K. A. Straub. “Using Games to Enrich Continuous Cyber Training.” Johns Hopkins APL Technical Digest 33, no. 2 (2015).
  • Bandura, Albert, Claudio Barbaranelli, Gian Vittorio Caprara, and Concetta Pastorelli. “Self-Efficacy Beliefs as Shapers of Children’s Aspirations and Career Trajectories.” Child Development 72, no. 1 (January 2001): 187–206. https://doi.org/10.1111/1467-8624.00273.
  • Bratosin, Bogdan Alexandru. “Cyber Defense Exercises and Their Role in Cyber Warfare | Journal of Mobile, Embedded and Distributed Systems,” December 2, 2014. http://jmeds.eu/index.php/jmeds/article/view/Cyber_Defense_Exercises_and_their_Role_in_Cyber_Warfare.
  • DeWitz, S. Joseph, and W. Bruce Walsh. “Self-Efficacy and College Student Satisfaction.” Journal of Career Assessment 10, no. 3 (August 2002): 315–26. https://doi.org/10.1177/10672702010003003.
  • Hutchison, Mica A., Deborah K. Follman, Melissa Sumpter, and George M. Bodner. “Factors Influencing the Self-Efficacy Beliefs of First-Year Engineering Students.” Journal of Engineering Education 95, no. 1 (January 2006): 39–47. https://doi.org/10.1002/j.2168-9830.2006.tb00876.x.
  • Jang, Hyewon. “Identifying 21st Century STEM Competencies Using Workplace Data.” Journal of Science Education and Technology 25, no. 2 (April 1, 2016): 284–301. https://doi.org/10.1007/s10956-015-9593-1.
  • John, Samuel Ndueso, Etinosa Noma-Osaghae, Funminiyi Oajide, and Kennedy Okokpujie. “Cybersecurity Education: The Skills Gap, Hurdle!” In Innovations in Cybersecurity Education, edited by Kevin Daimi and Guillermo Francia III, 361–76. Cham: Springer International Publishing, 2020. https://doi.org/10.1007/978-3-030-50244-7_18.
  • Kalnishkan, Yuri. “Learning Style Models and Teaching of Computer Science.” Accessed: Oct 6 (2005): 2019.
  • Katsantonis, Menelaos N., Ioannis Mavridis, and Dimitris Gritzalis. “Design and Evaluation of COFELET-Based Approaches for Cyber Security Learning and Training.” Computers & Security 105 (June 1, 2021): 102263. https://doi.org/10.1016/j.cose.2021.102263.
  • Katsantonis, N. Menelaos, Isavella Kotini, Panayotis Fouliras, and Ioannis Mavridis. “Conceptual Framework for Developing Cyber Security Serious Games.” In 2019 IEEE Global Engineering Education Conference (EDUCON), 872–81, 2019. https://doi.org/10.1109/EDUCON.2019.8725061.
  • Lent, Robert W., Hung-Bin Sheu, Daniel Singley, Janet A. Schmidt, Linda C. Schmidt, and Clay S. Gloster. “Longitudinal Relations of Self-Efficacy to Outcome Expectations, Interests, and Major Choice Goals in Engineering Students.” Journal of Vocational Behavior 73, no. 2 (2008): 328–35.
  • Lukowiak, Marcin, Stanisław Radziszowski, James Vallino, and Christopher Wood. “Cybersecurity Education: Bridging the Gap Between Hardware and Software Domains.” ACM Transactions on Computing Education 14, no. 1 (March 2014): 1–20. https://doi.org/10.1145/2538029.
  • Machado, R., P. Guerreiro, E. Johnston, M. Delimar, and M. Brito. “IEEEXtreme: From a Student Competition to the Promotion of Real-World Programming Education, Proceedings of 39th Frontiers in Education Conference.” San Antonio, 2009.
  • Martini, Ben, and Kim-Kwang Raymond Choo. “Building the next Generation of Cyber Security Professionals.” Martini B and Choo KK R, 2014. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2431592.

33 of 34

Works cited

​

34 of 34

QUESTIONS?