Assessing Competencies Using Scenario-Based Learning in Cybersecurity

Abstract

Recent years have seen a disconnect between much-needed real-world skills and knowledge imparted to cybersecurity graduates by higher education institutions. As employers are shifting their focus to skills and competencies when hiring fresh graduates, higher education institutions are facing a call to action to design curricula that impart relevant knowledge, skills, and competencies to their graduates, and to devise effective means to assess them. Some institutions have successfully engaged with industry partners in creating apprenticeship programs and work-based learning for their students. However, not all educational institutions have similar capabilities and resources. A trend in engineering, computer science, and information technology programs across the United States is to design project-based or scenario-based curricula that impart relevant knowledge, skills, and competencies. At our institution, we have taken an innovative approach in designing our cybersecurity courses using scenario-based learning and assessing knowledge, skills, and competencies using scenario-guiding questions. We have used the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework and the Office of Personnel Management (OPM) Hiring Cybersecurity Workforce report for skills, knowledge, and competency mapping. This paper highlights our approach, presenting its overall design and two example mappings.

Strategic Approaches to Cybersecurity Learning: A Study of Educational Models and Outcomes

“…In summary, this research spotlights effective teaching models in cybersecurity education, drawing on Ghosh et al (2021) [36] to provide an enriched view of contemporary cybersecurity education.…”

Application of intervention mapping in cybersecurity education design

“…Besides realistic scenarios, this approach involves competitions between attackers and defenders that involve students and has been shown to give better learning results (Cheung et al, 2011). Such scenariobased approaches have also been shown to be effective also for assessing competency development (Maennel et al, 2017;Ghosh and Francia, 2021). Such active learning techniques have been incorporated into cybersecurity education (Knox et al, 2019).…”