This paper presents and advocates for an initiative to expand access to secure programming education. The Strengthening Workforce Education: Excellence in Programming Securely (SWEEPS) initiative, funded by the National Centers of Academic Excellence in Cybersecurity (NCAE-C) program, seeks to advance secure programming and help achieve security aims. SWEEPS establishes a secure programming curriculum and workforce development coalition of seven institutions across two CAE (Center of Academic Excellence) regions (Northeast and Southwest) and five states (California, Massachusetts, Maryland, Indiana, and North Carolina). This coalition includes industry-based stakeholders collaborating with the US Army and government agencies on various projects. SWEEPS draws on prior work establishing critical concepts in secure programming, assessment tools, learning aids, and system infrastructure. The initiative offers a series of interconnected, stackable learning experiences tailored for early to mid-career professionals looking to enhance their cybersecurity skills. These experiences, which include practical one-day workshops and comprehensive year-long graduate certificates, provide a reassuring path for upskilling in secure programming. This paper recommends the efficacy of stackable training approaches in secure programming by exploring the practices of targeting and training individuals with diverse proficiency levels of programming experience who would benefit from increased knowledge and training.

Security failures in software arising from failures to practice secure programming are commonplace. Improving this situation requires that practitioners have a clear understanding of the foundational concepts in secure programming to serve as a basis for building new knowledge and responding to new challenges. We developed a Secure Programing Concept Inventory (SPCI) to measure students' understanding of foundational concepts in secure programming. The SPCI consists of thirty-five multiple choice items targeting ten concept areas of secure programming. The SPCI was developed by establishing the content domain of secure programming, developing a pool of test items, multiple rounds of testing and refining the items, and finally testing and inventory reduction to produce the final scale.

This Innovative Practice Full Paper describes an implementation of a Social Engineering course. Social Engineering (SE), which is the process of obtaining unauthorized access to systems by exploiting humans, has been flagged by the FBI and US Banking Industry as a threat to national security. According to a report by McAfee, the global cost of cybercrime has exceeded $1 trillion since 2018, and an additional $145 billion was spent on cybersecurity in 2020. Research has shown that 97% of cybersecurity attacks employ some element of social engineering. This Innovative Practice paper will present an effective and hands-on course designed to introduce students to social engineering penetration testing. The course is based on a social constructivism approach to learning, where students first develop an understanding of the individual and social context of social engineering. It uniquely combines the psychology of human behavior, legal precepts, and computer science to identify how psychological principles are applied in cyberspace to exploit individuals and how the same principles can be applied during SE penetration testing to detect vulnerabilities.

This Research Full Paper presents the results of a Delphi study. Industrial Control Systems (ICS) is a term used to describe highly integrated and mutually dependent systems made up of a complex network of hundreds of thousands of interconnected control systems. These systems usually incorporate different mass production and distribution elements to accomplish an industrial purpose. These highly integrated and mutually dependent systems have been deployed to manage, monitor, and control industrial infrastructure to provide essential services, such as electricity, energy, chemical, food and beverage, water, gas, oil, and traffic control systems. As these internet-connected systems and technologies continue to grow globally, the risks and threats of ICS cyberattacks' are rapidly increasing. If left susceptible to cyberattacks, any significant stoppage or interruption can cause real-world damages, considerable loss, and undesirable events. ICS security, the process of keeping these systems secure, is becoming a challenging priority for industrial organizations. A recent study conducted by the Center for Strategic International Studies (CSIS) showed that across eight countries of I.T. decisionmakers, 82 % of employers reported a cybersecurity skills shortage, and 71 % believe this talent gap poses direct and observable harm to their organization. A report by (ISC)2 found that there is a vast ICS cybersecurity workforce gap, and the cybersecurity workforce needs to grow 89% to meet industry needs in the United States and 145% to close the skills gap worldwide. The major factor driving the market is the increasing number of complex cyber-attacks on ICS systems, requiring a high demand for trained and skilled professionals in the ICS cybersecurity field. In 2016, a CSIS survey of IT employers found that only 23 % believed education curriculums were fully training students to join the cybersecurity industry. Likewise, in 2018, ISACA found that 61 % of institutes believe that fewer than half of those filling cybersecurity positions were qualified for the job. The current education curriculum lacks essential cybersecurity programs and degrees. It does not provide a strong foundation for building the role-specific knowledge necessary to meet the needs of the cybersecurity workforce. This deficiency needs to be urgently addressed through the creation of multiple, flexible programs in industrial control systems security. One of the first steps in this development is to identify the most critical knowledge, skills, and abilities necessary to become proficient in ICS security. This paper reports on a Delphi study designed to identify these foundational concepts and create a concept map based on the findings. This study used the Delphi method to develop the concept map. A selection of 25 experts in ICS security from academia, industry, and government were contacted and asked to outline a list of core knowledge areas. The researchers developed a summary of the experts' opinions. Two more rounds of input and feedback were solicited from the panel of experts. This paper describes the process and the resulting concept map describing the landscape of ICS cybersecurity.

In this Work In Progress in the Research Category we present a qualitative study that explores how computing instruction experiences may mediate the progression of social and cognitive factors associated with career development in community college engineering students. The rapidly evolving technological landscape has created an increased need for an engineering workforce with computing skills. Traditionally, policymakers, educators and researchers have focused on K-12 and four-year secondary institutions as the primary arena for addressing our workforce development needs. However, community colleges, which enroll over one-third of U.S. undergraduates, represent an important, and not yet fully utilized resource for training future engineers. However, there is a dearth of engineering education research that seeks to critically understand the experiences of community college engineering students in learning computational skills. To address this gap, our study includes semi-structured interviews with first- and second-year students enrolled in an engineering program at a public two-year institution in the midwestern United States. Our work is informed by a social cognitive career theory (SCCT) perspective from which we examine how engineering course learning experiences involving integrated computing instruction influence students' self-efficacy beliefs and outcome expectations. In alignment with SCCT, our analysis will aim to identify personal attributes and external environmental factors that mediate students' differential responses to computational instruction. This pilot study is the first part of a larger research effort directed towards learning how to support students as they navigate the community college pathway to engineering.

This Innovative Practice Work in Progress paper makes the case for using concept inventories in cybersecurity education and presents an example of the development of a concept inventory in the field of secure programming. The secure programming concept inventory is being developed by a team of researchers from four universities. We used a Delphi study to define the content area to be covered by the concept inventory. Participants in the Delphi study included ten experts from academia, government, and industry. Based on the results, we constructed a concept map of secure programming concepts. We then compared this concept map to the Joint Task Force on Cybersecurity Education Curriculum 2017 guidelines to ensure complete coverage of secure programming concepts. Our mapping indicates a substantial match between the concept map and those guidelines.

Structural analysis is a foundational statics concept for students majoring in mechanical engineering, civil engineering, and engineering technology, among others. However, the mathematical emphasis of a typical statics courses lies in algebraic calculations, matrices, vectors, and sometimes deemphasizes student understanding of the behavior of the overall structure as a system, focusing instead on its individual elements. This study investigates students' conceptual understanding of forces acting and reacting in a truss structure as well as their corresponding representations in the form of Free Body Diagrams (FBDs). Our findings suggest that students primarily demonstrated partially coherent answers suggesting that they may hold some misconceptions about truss behavior. The most prevalent error was that students failed to account for the mutual (equal and opposite) forces between connected bodies that were separated for analysis. Based on our findings we propose the design of a learning experience that combines principles of embodied learning with the affordances of visuohaptic simulations to address students' misconceptions.

We explored the affordances of using visuo-haptic simulations to improve conceptual understanding and representational competence of the concept of friction. Visuohaptic simulations are computer-based simulations that encode mathematical and physical models of certain phenomena and provide visual and tactile feedback. Users can see the simulation and feel the friction with their hand by using a special device connected to a computer. We hypothesized that visual and haptic feedback together can help students to improve learning of friction. We recruited 24 engineering technology students with a previous experience in at least one physics course, and we examined their reasoning and understanding about statics concepts before and after engaging with visuo-haptic simulations. Our instructional approach included four steps: 1) lecture about friction, 2) pretest, 3) laboratory session, and 4) posttest. The laboratory session consisted of a pre-training session, guided learning materials based on a constructivist framework, and use of the friction visuo-haptic simulation. We report students' prior conceptions of statics concepts, ways in which they interacted and reasoned with each of the different pedagogical tools, and compared reasoning processes, explanations and learning gains. Our results suggest that the visuo-haptic simulation helped students refine their explanations and increased the coherence between their verbal explanation and mathematical representation.

With the increasing proliferation of scientific knowledge and technological artifacts into society comes an increased need to regulate these artifacts and their use. The development and implementation of such regulations and laws in many cases requires both a technical understanding of the functioning of these artifacts and an understanding of how this technology interacts with social and natural systems, and would benefit from the involvement of a technical expert. Clearly, there is an important role to be filled by engineers in the public policy arena. However, there are very few engineers participating in public policymaking and very few engineering programs offer or encourage courses of study in policy. While there is agreement in the engineering education community that an increased focus on Engineering and Public Policy is a good idea, very little empirical evidence has been assembled to guide the establishment of these courses and programs. This paper reports on the development of an initiative at one university to develop a public policy curriculum for engineers that can easily be integrated into the existing engineering program.

The purpose of this study is to examine differences in student performance among engineering disciplines, as measured by term GPA's. Results indicate that: 1) Women outperform men in most engineering disciplines; 2) Student performance starts low at the freshman level, drops slightly at the sophomore level, and then increases over the junior and senior levels (without controlling for mortality); 3) Significant differences in GPA's remain between majors after controlling for relative SAT score, academic class level, race, and gender; 4) After controlling for major, relative SAT score, academic class level, and race, the gender gap in performance grows even larger.