Much of today’s cybersecurity efforts focus on underlying technologies influencing cyberspace operations. Installing, operating, and maintaining cybersecurity-related technologies (e.g., firewalls, intrusion prevention systems) have consumed government and commercial sectors; but, this unilateral attention on the technology has led to significant oversight. Although cybersecurity requires emphasis on technology, exclusive focus on hardware and software leads to lapses in the area that is arguably a critical aspect of any given system—human users. Consequently, a more holistic cybersecurity education strategy must be developed to focus on the gaps between cybersecurity-related technologies and the human domain.
This paper investigates one of the key gaps within cyber-education: the lack of human-centric curricula. To address this gap, we first attempted to identify the relevance of both techno-centric and human-centric knowledge, skills, and abilities (KSAs) within cybersecurity. 117 participants completed an online survey capturing perceptions of KSA relevance for five different cybersecurity scenarios pulled from the IBM X-Force Threat Intelligence Report 2016. Results indicated that a majority of participants found Human Computer Interaction, Criminal Psychology, Sociological Behavior, and Human Performance relevant KSAs in most of the scenarios. Specifically, Criminal Psychology and Sociological Behaviors were considered relevant or very relevant in all five scenarios.
The paper next outlines a pilot education program launched at the University of Central Florida (UCF), designed to address the unique challenges of the human dimension in cybersecurity. The purpose of highlighting this pilot program is to provide an example of human-centric cyber-educational curriculum. It is our hope that the information presented in the present paper will serve as a launching point for further discussion about the human side of cybersecurity.