To make cybersecurity concepts more accessible to non-technical students, we present our classroom-based study of CyberGuardian, an educational game designed to teach cryptographic primitives through simplified, real-world scenarios. Players assume the role of a cybersecurity advisor, providing guidance to simulated clients and analyzing authentic messages to assure confidentiality, data integrity, and authentication through three cryptographic primitives: symmetric encryption, asymmetric encryption, and digital signature. CyberGuardian is freely available, easy to deploy at scale, and implemented as a single-player offline game compatible with macOS and Windows. Our learning objectives are to enable students to: (1) Identify how an adversary can interfere with communications; (2) Explain how cryptographic primitives can mitigate dangers; and (3) Apply cryptographic primitives to reduce vulnerabilities.

MeetingMayhem is a web-based educational game focused on adversarial thinking in the context of network security. In particular, this game gently and non-technically introduces students without prior cybersecurity knowledge to the Dolev-Yao network intruder model. In MeetingMayhem, three students take on the roles of two agents and an adversary. Two agents need to agree on a time and location to exchange an essential asset. The agents communicate through a network controlled by the adversary without knowing the adversary's identity. The adversary can insert, block, or modify messages. Students can play different roles, try different strategies, interact with different players, and send different messages. MeetingMayhem is available as a Docker Image, with open-source code. MeetingMayhem provides an engaging and innovative way for novice students to learn about adversarial thinking and cryptography within 2 hours.

CyberGuardian is an interactive educational game that introduces students to foundational concepts in cybersecurity through authentic scenarios. Specifically, the game teaches students about cryptographic primitives and adversarial thinking. Targeted at students without computer science backgrounds, the game immerses players in practical cybersecurity challenges using simplified technical concepts. Players assume the role of a cybersecurity advisor, providing guidance to simulated clients and analyzing authentic messages to assure confidentiality, data integrity, and authentication through three cryptographic primitives: symmetric encryption, asymmetric encryption, and digital signature. Implemented as a single-player offline experience on Mac and Windows, CyberGuardian is scalable and broadly available.

We report on our experiences fielding MeetingMayhem, an interactive game that we developed, which introduces students to fundamental concepts in network security, cybersecurity, and adversarial thinking. The game is intended for students who do not necessarily have any prior background in computer science. Assuming the role of agents, two players exchange messages over a network to try to agree on a meeting time and location, while an adversary interferes with their plan. Following the Dolev-Yao model, the adversary has full control of the network: they can see all messages and modify, block, or forward them. We designed the game as a web application, where groups of three students play the game, taking turns being the adversary. The adversary is a legitimate communicant on the network, and the agents do not know who is the other agent and who is the adversary. Through gameplay, we expect students to be able to (1) identify the dangers of communicating through a computer network, (2) describe the capabilities of a Dolev-Yao adversary, and (3) apply three cryptographic primitives: symmetric encryption, asymmetric encryption, and digital signatures. We conducted surveys, focus groups, and interviews to evaluate the effectiveness of the game in achieving the learning objectives. The game helped students achieve the first two learning objectives, as well as using symmetric encryption. We found that students enjoyed playing Meeting Mayhem. We are revising MeetingMayhem to improve its user interface and to better support students to learn about asymmetric encryption and digital signatures.

Prior work has found that women tend to report lower sense of belonging compared to men in STEM and computing contexts, which may discourage women's persistence. Collaborative learning has been shown to improve students' sense of belonging in some STEM and computing courses relative to traditional lecturing; however, these studies tend to focus on a single course or the first implementation of such pedagogical changes. Our study explores whether these trends generalize by measuring students' sense of belonging across three non-introductory computing courses that have consistently used collaborative learning activities over three semesters. We ask the following research question: Is collaborative learning generally associated with an increased sense of belonging, especially for women? We found that while there were variations across courses, students' reported sense of belonging improved in all courses. Notably, women's reported sense of belonging improved 15% whereas men's reported sense of belonging improved by 11%. Our findings complement prior studies by providing evidence of a relationship between increased sense of belonging and collaborative learning, and suggest students' sense of belonging is malleable beyond the first year. These findings challenge critiques of past studies as being isolated to single courses or conducted only immediately after an effort to change a course, suggesting pedagogical changes may hold promise in improving students' affective outcomes.

We present a psychometric evaluation of the Cybersecurity Curriculum Assessment (CCA), completed by 193 students from seven colleges and universities. The CCA builds on our prior work developing and validating a Cybersecurity Concept Inventory (CCI), which measures students' conceptual understanding of cybersecurity after a first course in the area. The CCA deepens the conceptual complexity and technical depth expectations, assessing conceptual knowledge of students who had completed multiple courses in cybersecurity. We review our development of the CCA and present our evaluation of the instrument using Classical Test Theory and Item-Response Theory. The CCA is a difficult assessment, providing reliable measurements of student knowledge and deeper information about high-performing students.