Activity Simulation for Experiential Learning in Cybersecurity Workforce Development

摘要

A significant challenge to maintaining security within an organization is the training of a non-technical workforce to respond appropriately to cybersecurity threats. This work describes an online environment that utilizes experiential learning to give non-technical workers an increased exposure to issues in cybersecurity. We present a simulation-based approach that provides a better understanding of specific cybersecurity threats through experiential learning. The presented interface uses simulations of cybersecurity threats to provide concrete experiences rather than descriptions. While moving through the simulation, the user can attempt multiple actions and is provided with an "awareness" measure. For each, the system provides continuous feedback to allow active experimentation. After each threat has been exposed, the environment provides a narrative of the user's actions with suggested improvements to allow for reflective observation. This work includes a user study of the interface, shows the results of usability testing, and evaluates the effectiveness of the training through simulation.