Modern Aspects of Cyber-Security Training and Continuous Adaptation of Programmes to Trainees

Abstract

Nowadays, more-and-more cyber-security training is emerging as an essential process for the lifelong personnel education in organizations, especially for those which operate critical infrastructures. This is due to security breaches on popular services that become publicly known and raise people’s security awareness. Except from large organizations, small-to-medium enterprises and individuals need to keep their knowledge on the related topics up-to-date as a means to protect their business operation or to obtain professional skills. Therefore, the potential target-group may range from simple users, who require basic knowledge on the current threat landscape and how to operate the related defense mechanisms, to security experts, who require hands-on experience in responding to security incidents. This high diversity makes training and certification quite a challenging task. This study combines pedagogical practices and cyber-security modelling in an attempt to support dynamically adaptive training procedures. The training programme is initially tailored to the trainee’s needs, promoting the continuous adaptation to his/her performance afterwards. As the trainee accomplishes the basic evaluation tasks, the assessment starts involving more advanced features that demand a higher level of understanding. The overall method is integrated in a modern cyber-ranges platform, and a pilot training programme for smart shipping employees is presented.

Individual Differences on Conservative and Risky Behaviors about Information Security

“…Pattinson et al [58] put forth a concept framework of information security training considering individual differences of learning preferences. Hatzivasilis et al [59] developed an adoptable training program and a pilot system about cyber-security considering trainee type, trainee's needs and his/her performance. Our findings have implications for institutes and organizations as they can help to develop personalized training programs.…”

CYRA: A Model-Driven CYber Range Assurance Platform

“…The theory is rarely utilised to explain what factors are affecting users' compliance with security policies or even provide empirical evidence from their actual application. In general, it is suggested that training programmes should make use of methods and contents that are actively engaging trainees and motivate them to undergo systematic cognitive processing of the taught information [17,20]. Apart from modern technological tools (e.g., simulation, serious games), the continuous communication of the trainer with the learners is vital to improving users' security compliance [12,17,20].…”

“…Researches for security training ordinarily incorporate pedagogical principles as the primary methodology to enhance the user's compliance [18,20,21]. In 1998, Baldwin and Ford [22] defined the transfer of learning to the working environment as "the degree to which trainees effectively apply the knowledge, skills, and attitudes gained in the training context to the job".…”

“…Surveys for cybersecurity training in critical infrastructures, such as aviation, transportation, healthcare, energy, and nuclear sectors, are presented in [17][18][19][20]. In the last few years, there has been an increasing demand for cybersecurity professionals, which is expected to continue to grow [17].…”

“…The security KPIs were set in advance, and the trainers guided the trainees to accomplish them and adapt this knowledge back in their workplace. The main training life-cycle has been presented in our previous works [20], while this paper concentrates on the aforementioned modules for CTTP Models and Training Programmes adaptation and continuous security assurance in the operational system.…”