There are a wide range of information security awareness delivery methods such as Augmented / Virtual Reality, web-based training materials, online videos, games (online and physical) and “unplugged” methods. This study suggests that those methods are better which could reach a higher level of thinking according to the Bloom’s taxonomy. Finding a well-working method is very important because pupils can meet the dangers of the Internet at a very young age

Törley, Gábor

English

Gábor, Törley

ELTE Digital Institutional Repository (EDIT)

XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 91 TEACHING METHODS OF INFORMATION SECURITY AWARENESS: THE ROLE OF ENGAGEMENT Gábor Törley, HU Abstract: There are a wide range of information security awareness delivery methods such as Augmented / Virtual Reality, web-based training materials, online videos, games (online and physical) and “unplugged” methods. This study suggests that those methods are better which could reach a higher level of thinking according to the Bloom’s taxonomy. Finding a well-working method is very important because pupils can meet the dangers of the Inter-net at a very young age. Keywords: Bloom’s taxonomy, engagement, information security, delivery methods, teaching methods 1 Introduction Livingstone et al (2011) [10] lead a survey which investigated key online risks: pornography, bullying, receiving sexual messages, contact with people not known face-to-face, offline meetings with online contacts, potentially harmful user-generated content and personal data misuse. They showed that younger children tend to lack skills and confidence. However, most 11-16 year olds can block messages from those they do not wish to contact or find safety advice online. Around half can change privacy settings on a social net-working profile compare websites to judge their quality or block spam. They claim that digital skills training is needed in order to ensure that all children reach a minimum basic standard and to prevent digitally isolated and un-skilled children. The results of PISA 2018 assessment [11] have shown the same: the Hungar-ian students have performed below the OECD average in reading. Over 25% of Hungarian students performed below Level 2 proficiency in reading. At Level 2, students can identify the main idea in a piece of text of moderate length. Evaluating and reflecting has always been a part of reading literacy. In the era of digital reading, readers are now confronted with ever-growing amounts of information, and must be able to distinguish between what is trustworthy and what is not. This is also a part of information security aware-ness.  XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 92 2 Literature review Bloom's taxonomy – which was developed in 1950s – is possibly one of the best known and most widely used models of human cognitive processes. A revised version of the taxonomy was published in 2001 (Fig. 1.) [2].  Figure 1: Bloom’s Taxonomy, Original and Revised [18] Learning taxonomies can help describing and categorizing in cognitive, affec-tive and other dimensions, in which an individual operates as part of the learning process. in other words learning taxonomies help us to "understand about understanding". [15] The following is a brief explanation of each of the six levels of this revised taxonomy: • Remember – it refers to the rote recall and recognition of the previ-ously learned facts. The learner may not understand what he/she has learned. • Understand – On this level the learner can use in problem solving and decision making what he/she has understood. • Apply – The third level builds on the second one by adding the ability to use learned materials in new situations with a minimum of direc-tion. • Analyse – This level includes the ability to recognise the correspond-ent parts of a complex system and the understanding of the relation-ships between the parts and the whole. This means that the learner can break up a complex concept into simpler components in order to better understand its structure. XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 93 • Evaluate – Evaluation deals with the ability to judge the value of something based on specified criteria and standards. • Create – This is the highest level in the taxonomy and refers to the ability to put different parts together in order to conceive an idea or plan which is new to the learner. Information security awareness (ISA) can be defined as the level of compre-hension that users have about the importance of information security best practices. I other words, it is about establishing, promoting and maintaining good security habits [1]. The national curriculum of England [17] set two goals about information technology. All pupils • can evaluate and apply information technology, including new or unfamil-iar technologies, analytically to solve problems • are responsible, competent, confident and creative users of information and communication technology Examples on the topic “recommended activities” in the new Hungarian Cur-riculum Framework (2020) regarding information security [16]: • getting to know problems in electric communication practice and getting to know and using security settings which can respond to them (Grade 5-8) • debate on using e-commerce and e-business securely (Grade 9-11) • analysing the impacts security options regarding social networks (Grade 9-11) • maintenance and antivirus defence of a digital tool (Grade 9-11) The English curriculum refers much more on the higher level of Bloom’s Tax-onomy than the Hungarian curriculum framework. Aims in the English cur-riculum focus more on practical methods and understanding than knowledge like in the Hungarian curriculum framework. This seems to be a philosophi-cal difference between the two countries’ curriculum. Chou et al [4] identified four core Internet safety areas that teachers should be familiar with: 1. Communication security and safety. This area refers to teaching students how to protect themselves from viruses, hackers, spam (junk mail), and illegitimate commercial transactions, and how to safeguard their confi-dential information. 2. Information decency and appropriateness. This area concerns how to identify malicious rumours, pornography, sexual solicitation, XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 94 misleading advertising, and other offensive content. Also covered are both respects for copyright and ethical use of digital information. 3. Online interpersonal safety. This area refers to all social interactions, in-cluding making friends online, meeting net friends in person, cyberbul-lying, and digital etiquette, especially in the Web 2.0 age in which social networking is the main focus. 4. Computer-/Internet use safety. This is a miscellaneous category involv-ing proper equipment, a good work environment, eyesight protection, and posture. For most children across Europe (age 9-16), smartphones are now the pre-ferred means of going online. This often means that they have the majority of children reporting using their smartphones daily or almost all the time. [14] 2 Delivery methods Since information security awareness is the ability of recognize or avoid be-haviours that would compromise information security, that is why teaching methods cannot base on only lexical knowledge however getting to know the appropriate vocabulary is important. That is why frontal delivery methods should be extended in order to help the pupils not only to understand the vocabulary of ISA but to reach a higher level of thinking according to the tax-onomy. Augmented Reality (AR) / Virtual Reality (VR) and computer games have ad-vantages like effective skill transfer, knowledge acquisition and assessment in real-tome, safety of practice, greater engagement because it can be used out of class as well. Simulation is one of the best ways to learn how somebody can behave in dif-ferent situations. It can give a safe environment in order to experience con-sequences of good and bad decisions. Unfortunately, this method is expen-sive and developing of the virtual environment / game software needs a lot of effort and time. Usually, a school does not have enough resources for that. Developing a complex computer game is expensive but there are online games with which a pupil can learn different aspects of ISA. A good example is Anti-Phishing Phil [3, 13] With this game, pupils can learn what are those links on which they can click on securely and why. Unfortunately, this game is outdated because there is no mention on https protocol, and it was written in Flash. Online videos can be a good choice because they can be watched and re-watched as needed. In a classroom situation online videos can be a good in-troduction before a discussion of a topic. Videos can help to enter into the XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 95 actors’ feeling, understand their situation, etc. There are cartoons for younger children as well so this method can be used from the very beginning. A very good example on that is Sheeplive project [12]. Originally, “CS Unplugged is a collection of free teaching material that teaches Computer Science through engaging games and puzzles that use cards, string, crayons and lots of running around” [6]. I use “CS unplugged” as a teaching method when I do not use any computer-based method in order to teach con-cepts on informatics. This method can include games (even table games or situation games), drama methods [9], other activities. There are great unplugged activities on Code.org [5] on ISA. Most of these activities contains a lesson plan, lesson and teacher videos as well as all of the resources what a teacher need. These activities can be used for first grader pupils as well. Table (or physical) games can be a good way to support understanding be-cause they can • engage people, • give permission to test ideas and ask questions, • create social environments, which can foster interaction and discussion on the topic of the class. [7] Usually this kind of games do not require extensive setup or have resource dependencies. Online quizzes can be a useful tool to measure the understanding of the pu-pils. It is important that these quizzes should have practical questions which point to situations. A very good example of that is the Phishing Quiz by Jigsaw [8]. This quiz asks the learner to give his/her name and e-mail address (which will not be stored) in order to make the quiz and the situation more personal. All of the tasks are very practical and after every answer, learners can read more on the situation mentioned be the task. 3 Conclusion and future work This paper summarized those delivery methods with examples on ISA which can lead learners not only to get to know the concepts of ISA but to under-stand, analyse and evaluate them. It is very important to find and apply teaching methods which can be used for younger children because a big majority of them can face with dangers of the internet and social media. They need “tools” in order to decide what is secure and what is not. Unplugged activities seem to a good way to teach them these concepts from Grade 1. XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 96 Students need games (even physical ones) that examine their understanding not only of the concepts but also how to apply them in real life. Next step of my research is to create a cybersecurity program based on the new Hungarian Curriculum Framework using the above-mentioned meth-ods. The research has been supported by the European Union, co-financed by the Euro-pean Social Fund (EFOP-3.6.2-16-2017-00013, Thematic Fundamental Research Collaborations Grounding Innovation in Informatics and Infocommunications). References 1. ABAWAJY, J User preference of cyber security awareness delivery methods, In. Be-haviour & Information Technology, 33:3, 237-248, 2013, DOI: 10.1080/0144929X.2012.708787 2. ANDERSON, L. – KRATHWOHL, D. – AIRASIAN, P. – CRUIKSHANK, K. – MAYER, R., PINTRICH, P. – RATHS, J. – WITTROCK, M. A Taxonomy for Learning, Teaching, and Assessing: A Revision of Bloom's Taxonomy of Educational Objectives, Complete Edi-tion. Longman 2001 3. Anti-phising game, https://www.ucl.ac.uk/cert/antiphishing/ Retrieved: 09.06.2020 4. CHOU, C. – PENG, H., Promoting awareness of Internet safety in Taiwan in-service teacher education: A ten-year experience, In. The Internet and Higher Education, Volume 14, Issue 1, 2011, Pages 44-53, ISSN 1096-7516 5. CS Fundamentals Unplugged Lessons, https://code.org/curriculum/unplugged Retrieved 10.06.2020. 6. CS Unplugged https://csunplugged.org/en/ Retrieved: 09.06.2020. 7. DENNING. T. – LERNER, A. – SHOSTACK, A., – KOHNO, T.. 2013. Control-Alt-Hack: the design and evaluation of a card game for computer security awareness and education. In Proceedings of the 2013 ACM SIGSAC conference on Computer & com-munications security (CCS ’13). Association for Computing Machinery, New York, NY, USA, 915–928. 2013 DOI:https://doi.org/10.1145/2508859.2516753 8. Jigsaw Phishing Quiz, https://phishingquiz.withgoogle.com/ Retrieved: 10.06.2020. 9. JOZITFEK, ZS. (Ed.) R.U.In? Drama methods’ innovation for inclusive youth commu-nities, Open Circle Association, 2018 10. LIVINGSTONE, S. – HADDON, L. – GÖRZIG, A. – ÓLAFSSON, K. Risks and safety on the internet: the perspective of European children: summary. EU Kids Online, Deliv-erable D4, EU Kids Online Network, London, UK. 2011 11. OECD 2019. PISA 2018 Results (Volume I): What Students Know and Can Do, PISA, OECD Publishing, Paris https://doi.org/10.1787/5f07c754-en 12. Sheeplive https://sheeplive.eu/ Retrieved:09.06.2020 13. SHENG, S. – MAGNIEN, B. – KUMARAGURU, P. – ACQUISTI, A. – CRANOR, L. – HONG, J. – NUNGE, E.. Anti-Phishing Phil: The Design and Evaluation of a Game XXXIII DIDMATTECH 2020 EÖTVÖS LORÁND UNIVERSITY (ELTE) FACULTY OF INFORMATICS 97 That Teaches People Not to Fall for Phish. In Proceedings of the 2007 Symposium On Usable Privacy and Security, Pittsburgh, PA, July 18-20, 2007. 14. SMAHEL, D. – MACHACKOVA, H., – MASCHERONI, G. – DEDKOVA, L. – STAKSRUD, E. – ÓLAFSSON, K. – LIVINGSTONE, S., – HASEBRINK, U. (2020). EU Kids Online 2020: Survey results from 19 countries. EU Kids Online. Doi: 10.21953/lse.47fdeqj01ofo 15. SOUSA, D.A. How the brain learns. 3rd edn. Corwin Press 2006 16. The Curriculum Framework of Hungary (in Hungarian) (2020) https://www.ok-tatas.hu/kozneveles/kerettantervek/2020_nat (retrieved: 05.06.2020) 17. The national curriculum of England: Computing (2013) https://www.gov.uk/gov-ernment/publications/national-curriculum-in-england-computing-programmes-of-study/national-curriculum-in-england-computing-programmes-of-study Re-trieved: 04.06.2020. 18. VAN NIEKERK J. – VON SOLMS R.  Using Bloom’s Taxonomy for Information Se-curity Education. In: Dodge R.C., Futcher L. (eds) Information Assurance and Secu-rity Education and Training. WISE 2013, WISE 2011, WISE 2009. IFIP Advances in Information and Communication Technology, vol 406. Springer, Berlin, Heidel-berg, 2013 Reviewed by: Dr. Csaba Holló, PhD. Contact address Gábor Törley, PhD., ORCID: 0000-0002-0496-936 ELTE Eötvös Loránd University, Faculty of Informatics, 3in Research Group, Mar-tonvásár, Hungary Address: H-1117 Budapest, Pázmány P. sétány 1/C, Hungary e-mail: gabor.torley@inf.elte.hu  

Teaching methods of information security awareness: the role of engagement

Repository of the Academy's Library

https://edit.elte.hu/xmlui/bitstream/handle/10831/50831/G%c3%a1borT%c3%b6rley-paper.pdf?sequence=1&amp;isAllowed=y

Teaching methods of information security awareness: the role of engagement

Abstract

Similar works

Full text

Available Versions

ELTE Digital Institutional Repository (EDIT)

Repository of the Academy's Library