SOK: Young Children's Cybersecurity Knowledge, Skills & Practice: A Systematic Literature Review

Abstract

The rise in children's use of digital technology highlights the need for them to learn to act securely online. Cybersecurity skills require mature cognitive abilities which children only acquire after they start using technology. As such, this paper explores the guidance and current curriculum expectations on cybersecurity aspects in Scotland. Additionally, a systematic review was undertaken of the literature pertaining to cybersecurity education for children on a wider scale including papers from around the world, with 27 peer reviewed papers included in the final review. We discovered that most research focused on assessing children's knowledge or investigating the efficacy of interventions to improve cybersecurity knowledge and practice. Very few investigated the skills required to carry out the expected cybersecurity actions. For example, high levels of literacy, mature short-and long-term memory, attention, and established meta cognition are all pre-requisites to be able to carry out cybersecurity activities. Our main finding is that empirical research is required to explore the ages at which children have developed essential cognitive abilities and thereby the potential to master cybersecurity skills.

Who Is Best Placed to Support Cyber Responsibilized UK Parents?

“…Throughout the UK, cybersecurity is included in the curriculum for children throughout their time at school. However, the extent to which it is covered varies by individual nation [38]. In addition, no curriculum in England fully covers the basic topics defined by the UK government as being necessary for good personal cybersecurity [39].…”

“…However, there are issues with many of these, in particular books, which have often been found to contain out-of-date or incorrect guidance [46]. In addition, even when children are able to engage independently with the many online resources [38], they still require input from adults to explain how to apply the principles. That being so, we cannot feasibly expect children to teach themselves the correct principles.…”

“…Moreover, teachers' workloads are such that it is unlikely they have the bandwidth to keep up with the latest cybersecurity developments or to provide support to parents [59]. Cybersecurity education is indeed included in primary school curricula, but the topics and approaches to teaching these vary, depending on the educational authority [38]. Moreover, childhood deprivation has a deleterious impact on how well children learn these principles at school [30].…”