Phishing is an online identity theft that aims to steal sensitive information such as username, passwords and online banking details from its victims. Phishing education needs to be considered as a means to combat this threat. This book focuses on a design and development of a mobile game prototype as an educational tool helping computer users to protect themselves against phishing attacks. The elements of a game design framework for avoiding phishing attacks were used to address the game design issues. The mobile game design aimed to enhance the user's avoidance behaviour through motivation to protect themselves against phishing threats. A think-aloud study was conducted, along with a pre- and post-test, to assess the game design framework through the developed mobile game prototype. The study results showed a significant improvement of participants' phishing avoidance behaviour in their post-test assessment. Furthermore, the study findings suggest that participants' threat perception, safeguard effectiveness, self-efficacy, perceived severity and perceived susceptibility elements positively impact threat avoidance behaviour, whereas safeguard cost had a negative impact on it.
Gamification and Serious Games are progressively being used over a host of fields, particularly to support education. Such games provide a new way to engage students with content and can complement more traditional approaches to learning. This article proposes SherLOCKED, a new serious game created in the style of a 2D top-down puzzle adventure. The game is situated in the context of an undergraduate cyber security course, and is used to consolidate students' knowledge of foundational security concepts (e.g. the CIA triad, security threats and attacks and risk management). SherLOCKED was built…
The lack of guided exercises and practical opportunities to learn about cybersecurity in a practical way makes it difficult for security experts to improve their proficiency. Capture the Flag events and Cyber Ranges are ideal for cybersecurity training. Thereby, the participants usually compete in teams against each other, or have to defend themselves in a specific scenario. As organizers of yearly events, we present a taxonomy for interactive cyber training and education. The proposed taxonomy includes different factors of the technical setup, audience, training environment, and training setu…
When using security questions most users still trade-off security for the convenience of memorability. This happens because most users find strong answers to security questions difficult to remember. Previous research in security education was successful in motivating users to change their behaviour towards security issues, through the use of serious games (i.e. games designed for a primary purpose other than pure entertainment). Hence, in this paper we evaluate the design of a serious game, to investigate the features and functionalities that users would find desirable in a game that aims to …
Adversary thinking is an essential skill for cybersecurity experts, enabling them to understand cyber attacks and set up effective defenses. While this skill is commonly exercised by Capture the Flag games and hands-on activities, we complement these approaches with a key innovation: undergraduate students learn methods of network attack and defense by creating educational games in a cyber range. In this paper, we present the design of two courses, instruction and assessment techniques, as well as our observations over the last three semesters. The students report they had a unique opportunity…
Research into responsible management education has largely focused on the merits, attributes, and transformation opportunities to enhance responsible business school education aims. As such, a prominent part of the literature has occupied itself with examining if responsible management modules are inherently considered a non-crucial element of the curriculum and determining the extent to which business schools have introduced such learning content into their curriculum. However, there has been scant research into how to apply novel teaching approaches to engage students and promote responsible…
E-learning is a widely used learning method, but with the development of society, traditional E-learning method has exposed some shortcomings, such as the boring way of teaching, so that it is difficult to increase the enthusiasm of students and raise their attention in class. The application of serious games in E-learning can make up for these shortcomings and effectively improve the quality of teaching. When applying serious games to E-learning, there are two main considerations: educational goals and game design. A successful serious game should organically combine the two aspects and balan…
Because of todays technological developments and the influence of digital systems into every aspect of our lives, importance of cyber security improves more and more day-by-day. Projects, educational processes and seminars realized for this aim create and improve awareness among individuals and provide useful tools for growing equipped generations. The aim of this study is to focus on a cyber security eco-system, which was self-occurred within the interactive educational environment designed under the scope of TUBITAK 4004 Nature Education and Science Schools Projects (with the name of A Cyber…
As internet related challenges increase such as cyber-attacks, the need for safe practises among users to maintain computer system's health and online security have become imperative, and this is known as cyber-hygiene. Poor cyber-hygiene among internet users is a very critical issue undermining the general acceptance and adoption of internet technology. It has become a global issue and concern in this digital era when virtually all business transactions, learning, communication and many other activities are performed online. Virus attack, poor authentication technique, improper file backups a…
In recent years, digital technologies have grown in many ways. As a result, many school-aged children have been exposed to the digital world a lot. Children are using more digital technologies, so schools need to teach kids more about cyber security and online safety. Because of this, there are now more school programmes and projects that teach students about cyber security and online safety and help them learn and improve their skills. Still, despite many programmes and projects, there is not much proof of how many schools have taken part and helped spread the word about them. This work shows…
Serious games are beneficial for education in various computer science areas. Numerous works have reported the experiences of using games (not only playing but also development) in teaching and learning. Considering it could be difficult for teachers/students to prepare/develop a game from scratch during one semester, assistant educational materials would be crucial in the corresponding courses. Unfortunately, the literature shows that not many materials from educational game projects are shared. To help different educators identify suitable courseware and help students implement game developm…
This entry introduces educational games in secondary schools. Educational games include three main types of educational activities with a playful learning intention supported by digital technologies: educational serious games, educational gamification, and learning through game creation. Educational serious games are digital games that support learning objectives. Gamification is defined as the use of "game design elements and game thinking in a non-gaming context" (Deterding et al. 2011, p. 13). Educational gamification is not developed through a digital game but includes game elements for su…
The increasing pervasiveness of internet-connected systems means that such systems will continue to be exploited for criminal purposes by cybercriminals (including malicious insiders such as employees and vendors). The importance of protecting corporate system and intellectual property, and the escalating complexities of the online environment underscore the need for ongoing information security awareness and education training and the promotion of a culture of security among employees. Two honeypots were deployed at a private university based in Singapore. Findings from the analysis of the ho…
School of Computer Science, The University of Manchester（曼彻斯特大学计算机科学学院）；Engineering at Mastered Software, Los Angeles（Mastered Software 工程部，洛杉矶）
The ultimate goals of serious education games (SEG) are to facilitate learning and maximizing enjoyment during playing SEGs. In SEG development, there are normally two spaces to be taken into account: knowledge space regarding learning materials and content space regarding games to be used to convey learning materials. How to deploy the learning materials seamlessly and effectively into game content becomes one of the most challenging problems in SEG development. Unlike previous work where experts in education have to be used heavily, we proposed a novel approach that works toward minimizing t…
Ohio Supercomputer Center（俄亥俄超级计算中心）；The Ohio State University（俄亥俄州立大学）
Cyber Physical Systems (CPS) are the conjoining of an entities' physical and computational elements. The development of a typical CPS system follows a sequence from conceptual modeling, testing in simulated (virtual) worlds, testing in controlled (possibly laboratory) environments and finally deployment. Throughout each (repeatable) stage, the behavior of the physical entities, the sensing and situation assessment, and the computation and control options have to be understood and carefully represented through abstraction. The CPS Group at the Ohio State University, as part of an NSF funded CPS…
Cyber literacy merits serious research attention because it addresses a confluence of specialization and generalization; cybersecurity is often conceived of as approachable only by a technological intelligentsia, yet its interdependent nature demands education for a broad population. Therefore, educational tools should lead participants to discover technical knowledge in an accessible and attractive framework. In this paper, we present Protection and Deception (P&G), a novel two-player board game. P&G has three main contributions. First, it builds cyber literacy by giving participants "hands-o…
The revolution of internet technology and its usage have led a significant increase in the number of online transactions and electronic data transfer, parallely increased the number of cybercrime incidents around the world. Steady economic growth in the Sultanate of Oman accelerated the volume of online utilization for e-commerce, banking, communication, education and so forth. Normally attackers target the users who ignore security practices due to the lack of information security awareness. Unawareness of information security practices, user negligence, lack of awareness programs and trainin…
Phishing continues to be a difficult problem for individuals and organisations. Educational games and simulations have been increasingly acknowledged as enormous and powerful teaching tools, yet little work has examined how to engage users with these games. We explore this problem by conducting workshops with 9 younger adults and reporting on their expectations for cybersecurity educational games. We find a disconnect between casual and serious gamers, where casual gamers prefer simple games incorporating humour while serious gamers demand a congruent narrative or storyline. Importantly, both …
Cybercrimes are on the rise, in part due to technological advancements, as well as increased avenues of exploitation. Sophisticated threat actors are leveraging on such advancements to execute their malicious intentions. The increase in cybercrimes is prevalent, and it seems unlikely that they can be easily eradicated. A more serious concern is that the community may come to accept the notion that this will become the trend. As such, the key question revolves around how we can reduce cybercrime in this evolving landscape. In our paper, we propose to build a systematic framework through the len…
In spite of the growing importance of software security and the industry demand for more cyber security expertise in the workforce, the effect of security education and experience on the ability to assess complex software security problems has only been recently investigated. As proxy for the full range of software security skills, we considered the problem of assessing the severity of software vulnerabilities by means of a structured analysis methodology widely used in industry (i.e. the Common Vulnerability Scoring System (\CVSS) v3), and designed a study to compare how accurately individual…
The use of educational games for pedagogical practice can provide new conceptions of teaching-learning in an interactive environment stimulating the acquisition of new knowledge. The so-called serious games are focused on the goal of transmitting educational content or training to the user. In the context of entrepreneurship, serious games appear to have greater importance due to the multidisciplinary of the knowledge needed. Therefore, we propose the adoption of the Entrexplorer game in the context of a university classroom. The game is a cloud-based serious game about the theme of entreprene…
Cyber attacks have become serious threats to Industrial Control systems as well. It becomes important to develop a serious threat defense system against such vulnerabilities. For such process control systems, safety should also be assured apart from security. As unearthing vulnerabilities and patching them is not a feasible solution, these critical infrastructures need safeguards to prevent accidents, both natural and artificial, that could potentially be hazardous. Morita proposed an effective Zone division, capable of evaluating remote and concealed attacks on the system, coupled with Princi…
As the information and communication system has become an essential element for national operation and people's lives, and the dependence on information and communication systems such as national infrastructure systems and facilities increases, cyber terrorism is rapidly emerging as a serious threat to national security in peacetime. As terrorist groups' access to cyber-attack assets improves, the traditional form of terrorism is also expected to change to a form combined with cyber-terrorism. Nevertheless, from a national security point of view, Korea lacks a legal system to prepare for and r…
While cyber security has become a prominent concept of emerging information governance, the Kingdom of Saudi Arabia has been dealing with severe threats to individual and organizational IT systems for a long time. These risks have recently permeated into educational institutions, thereby undermining the confidentiality of information as well as the delivery of education. Recent research has identified various causes and possible solutions to the problem. However, most scholars have considered a reductionist approach, in which the ability of computer configurations to prevent unwanted intrusion…
The explosion in the e-commerce industry which has been necessitated by the growth and advance expansion of Information technology and its related facilities in recent years have been met with adverse security issues consequently affecting the industry and the entire online activities. This paper exams the prevailing security threats e-commerce is facing which is predominantly known as cyber-crime and how computer related technology and facilities such as digital forensics tools can be adopted extensively to ensure security in online related business activities. This paper investigated the ris…
SentinelSphere: Integrating AI-Powered Real-Time Threat Detection with Cybersecurity Awareness Training
Institute of Communications and Computer Systems (ICCS), National Technical University of Athens（雅典国家技术大学通信与计算机系统研究所）；National Technical University of Athens（雅典国家技术大学）；DASKALOS-APPS
This Work-In-Progress Paper for the Innovative Practice Category presents a novel experiment in active learning of cybersecurity. We introduced a new workshop on hacking for an existing science-popularizing program at our university. The workshop participants, 28 teenagers, played a cybersecurity game designed for training undergraduates and professionals in penetration testing. Unlike in learning environments that are simplified for young learners, the game features a realistic virtual network infrastructure. This allows exploring security tools in an authentic scenario, which is complemented…
This paper presents a game based on storytelling, in which the players are faced with ethical dilemmas related to software engineering specific issues. The players' choices have consequences on how the story unfolds and could lead to various alternative endings. This Ethics Game was used as a tool to mediate the learning activity and it was evaluated by 144 students during a Software Engineering Course on the 2017-2018 academic year. This evaluation was based on a within-subject pre-post design methodology and provided insights on the students learning gain (academic performance), as well as o…
Charles Sturt University（查尔斯特大学）；University of Colombo（科伦坡大学）；Vellore Institute of Technology（韦洛尔理工学院）；Dongguk university（东国大学）
Internet of Things (IoT) devices are rapidly becoming universal. The success of IoT cannot be ignored in the scenario today, along with its attacks and threats on IoT devices and facilities are also increasing day by day. Cyber attacks become a part of IoT and affecting the life and society of users, so steps must be taken to defend cyber seriously. Cybercrimes threaten the infrastructure of governments and businesses globally and can damage the users in innumerable ways. With the global cybercrime damages predicted to cost up to 6 trillion dollars annually on the global economy by cyber crime…
