Study on the Impact of Learning About Information Security Measures on Mental Models: Applying Cybersecurity Frameworks to Self-learning Materials

摘要

The shortage of information-security workers is a problem. Appropriate mental models are considered important to encourage learners to appropriately plan, understand, and act on security measures. We aim to create materials to help security staff members acquire the right mental model in their learning and improve the learning effect. To create such materials, it is important to investigate the current mental model of the staff, how the model changes through learning, and its impact on the learning efficiency.A preliminary experiment was conducted on individuals who had not received such education and individuals who had participated in security-related work for a few to several years. The participants self-studied both standard and revised materials on information security measures, and we conducted tests and semi-structured interviews to examine the changes in their performance and confidence as well as the changes to their mental models before and after self-learning.Four mental models were identified during the experiment: role-based, timeline/phase-based, framework-based, and unstructured models. After learning, for those with security-related work experience, we identified examples of changing to a framework-based model, and for groups with no security education, we identified examples of acquiring a role-based model. Instances when the model did not change were also noted. The test scores and degree of confidence of both groups improved after the self-learning, and a significant difference was shown for questions regarding which security measures contribute to which security function based on a small sample size.