This paper outlines a method to streamline the setup and support of an introductory cybersecurity engineering course that uses experiential learning laboratory exercises. Experiential learning requires students to get direct, hands-on experience with real-world problems and solutions. The course under discussion is the first course in a series of three core cybersecurity engineering classes at a large Midwestern university that has earned ABET accreditation and the NSA Center for Academic Excellence in Cyber Defense (CAE-CD) designation. Course topics include networking, computer virtualization, secure configuration, and troubleshooting. During the 16-week semester students in the course build their own “corporate” network inside the ISELab virtual laboratory. They configure and secure services such as DNS, email, web, directory,firewalls, and VPN. Using a set of vSphere products including vCenter and ESXi, as well as the PowerCLI command line tool, a set of scripts were developed that allow us to rapidly deploy, modify, and delete multiple machines in each student's “corporate” network. The novelty of this contribution is the incorporation of industry standard tools into the administration of the course. The utilization of these tools significantly reduced setup and management time, enabled us to focus and enhance topics and lab activities, and made it easier to share the materials with other faculty members.

This paper examines the effectiveness of adding formative assessment in the form of digital entrance and exit tickets to an introductory cybersecurity engineering course at a large Midwestern university. The set of entrance and exit tickets that offered low-stakes, weekly feedback for students to evaluate their understanding of the material was added to the Fall 2022 laboratory experiential learning activities. Entrance tickets focused students' attention on the task they were about to undertake, while exit tickets allowed the students to reflect on the outcomes of the lab. The laboratory report and examination scores from Fall 2022 were compared to Fall 2021. A statistically significant positive difference between the two semesters was found in overall lab scores and the second examination. Additionally, formative feedback showed the greatest benefit for sophomores and juniors.

The Internet of Things, or IoT, is a paradigm in which devices interact with the physical world through sensors and actuators, while still communicating with other computers over various types of networks. IoT devices can be found in many environments, often in the hands of non-technical users. This presents unique security concerns, since compromised devices can be used not only for typical objectives like network footholds, but also to cause harm in the real world (for instance, by unlocking the door to a house or changing safety configurations in an industrial control system). This work in progress paper presents a series of laboratory exercises under development at a large Midwestern university that introduces undergraduate cyber security engineering students to the Internet of Things and its (in)security considerations. The labs will be part of a 400-level technical elective course offered to cyber security engineering majors. The design of the labs has been grounded in the experiential learning process. The concepts in each lab module are couched in hands-on activities and integrate real world problems into the laboratory environment. The laboratory exercises are conducted using an Internet testbed and a combination of actual IoT devices and virtualized devices to showcase various IoT environments, vulnerabilities, and attacks.

This paper examines group-level social support and barrier effects on the individual intent to major in information technology (IT) using the social cognitive career theory (SCCT.) For the purposes of this program, IT majors are broadly inclusive, encompassing computer science, computer engineering, software engineering, and information systems. A multilevel approach allows examination of how self-efficacy within a group of students at a high school impacts the individual intention to major. The sample is more than 300 students from 40 different high schools across a Midwestern state who enrolled in a year-long inquiry-based educational program on IT-related topics including game design, cyber defense, and robotics. The results showed a higher self-efficacy in IT at the high school level had a strong positive impact on individual student choice to major in IT. This holds true even when the student's individual self-efficacy in IT had no significant impact. Therefore, the axiom that the rising tide raises all boats holds true.

Universities are now seeing the post-Millennial generation enrolling in freshman engineering courses. These outcome-oriented students engage with the course topics if they can see how the skills being developed can be used outside the classroom. To this end, the authors substituted a contemporary game controller, a PlayStation4 DualShock4 (DS4), for a microcontroller with sensors (Arduino Esplora) that was used in the freshman laboratory exercises to enhance the connection to the “real world” and increase engagement with the course concepts. Using laboratory scores from two consecutive fall semesters at a large, Midwestern university, the authors found the substitution of the DS4 for the Esplora had a significant positive effect on the total scores for the entire semester, as well as positive significant effect on the formalized lab reports.

In the United States, the number of students entering into and completing degrees in science, technology, engineering, and mathematics (STEM) areas has declined significantly over the past decade. Although modest increases have been shown in enrollments in computer-related majors in the past 4 years, the prediction is that even in 3 to 4 years when these students graduate, there will be shortages of computer-related professionals for industry. The challenge on which this article focuses is attracting students to select an information technology (IT) field such as computer science, computer engineering, software engineering, or information systems as a major when many high schools do not offer a single computer course, and high school counselors, families, and friends do not provide students with accurate information about the field. The social cognitive career theory (SCCT) has been used extensively within counseling and career psychology as a method for understanding how individuals develop vocational interests, make occupational choices, and achieve success within their chosen field. In this article, the SCCT model identifies factors that specifically influence high school students to select a major in an IT-related discipline. These factors can then be used to develop new or enhance existing IT-related activities for high school students. Our work demonstrates that both interest and outcome expectations have a significant positive impact on choice to major. Interest also is found to mediate the effects of self-efficacy and outcome expectations on choice of major. Overall, the model predicts a good portion of variance in the ultimate outcome of whether or not an individual chooses to major in IT.

The importance of laboratory exercises for students is recognized unilaterally by engineering and technology programs. As engineering educators whose academic focus is information assurance and cyber security, we believe students in cyber security need the same type of access to hands on opportunities as their counter parts in hardware design or circuit design. Students should be able to configure and run their own networks, as well as explore the vulnerabilities, exploits, and remediatios needed in a cyber security professional's tool kit. Further, they need exposure to working in the complexity of the Internet. While some might argue that simulation software could be a solution, it often lacks realism. In this paper we show how our institution goes beyond the providing the standard, formalized laboratory activities for our cyber security students by developing a unique, highly configurable testbed called Internet-Scale Event and Attack Generation Environment (ISEAGE - pronounced “ice age”) that allows us to imitate the Internet. ISEAGE provides a controlled environment that allows real attacks to be played out against the students' networks and demonstrates to them real world security concepts. This paper provides an overview of how the ISEAGE security testbed functions, as well as illustrates how ISEAGE provides our students five different types of opportunities for real world experience: support of formalized classroom work; cyber defense competitions for high school, community college and four year students; inquiry-based learning in a playground environment for high school, as well as college students; testing environment for network devices such as firewalls, data loss protection, intrusion detection; research environment for senior and graduate student work.

The IT-Adventures program is designed to increase high school students' interest in information technology (IT) as a career. It allows them to learn about IT in non-threatening, extracurricular IT-Club activities using inquiry-based learning. The IT-Clubs have four tracks from which students can select to study: cyber defense, game design programming, robotics, and multimedia. This paper focuses on the cyber defense venue and the need for students to have equal access to computing equipment on which to learn about computer operating systems, networking, and information security prior to competing in a cyber defense competition (CDC) at the end of the academic year. The creation of a remotely located and managed “playground” provides uniform access to equipment across schools. This paper shares our knowledge and experience in creating the “playground”.

Society's dependency on information technology has drastically outpaced educational curricula and the opportunities that universities and higher education institutes provide to students from both technical (e.g., computer engineering, computer science) and non-technical majors. To increase the opportunities for all students to learn how protect themselves as individuals and others as professionals from numerous cyber threats the focus of this work is to identify gaps in engineering curricula and present novel approaches to fulfill the growing and diverse needs of cyber security education. The overall objective of this paper is to make security education accessible, relevant, and tangible across educational curricula, as well as to provide the framework to extend these efforts beyond university classrooms and into community colleges and high schools. While the predominant focus, research, and innovative practices in the area of cyber security have focused on technical students at the university level, this work instead concentrates on the demographic of students that desire to learn about cyber security without having to major in computer engineering, for example. In this paper we present a three-tiered framework that provides breadth and depth to security education across multiple education levels. This all-encompassing framework for security education includes providing (1) formal literacy-based training for students of all backgrounds, (2) inquiry-based learning through security- and technically-focused student groups and activities, and (3) classical technical·based initiatives. For each of these respective areas, previous research and efforts are discussed as well as the innovative practices that we have developed to address identified educational gaps.

We are losing the battle in cyber security. We heavily rely on technology as the main defense, instead of recognizing that the easiest attack vectors are the people who operate the computers. The general public does not understand the decisions they make each and every day have security implications for themselves, their projects and their companies. Since people are a primary target, education is one of the “secret weapons” in the cyber security battlefield. Further, if everyday users are the targets, then all audiences, not just technical staff, need training and education in cyber security basics. We argue that computer security literacy is not only the next step in computer security defense; it may be one of the most important steps we can take. Through this workshop we want to encourage the profession to reach out to the populous and help make them security literate. The goal of the workshop is to provide an alternative approach to teaching Computer Security Literacy. This approach, developed at Iowa State University, demonstrates how Computer Security Literacy courses for non-technical students benefit them in their daily lives, now as students and in the future as working professionals.