The challenge of cybersecurity is intrinsically interdisciplinary, involving technical, psychological and economic elements. To date, much of the emphasis in cybersecurity education has focused on the technical side. The goal of the project was to develop educational materials specifically appropriate to build cybersecurity decision-making skills across all three domains. The pedagogical approach involved developing open access authentic discussion case studies of the type that are most commonly used in business education. Also included in the project goals were pilot testing the cases in a cybersecurity capstone course, offering faculty education on the use and development of cases through workshops, and the publication of all materials produced for the project.

Each of the cases developed for the project involved a study of a real-world situation. The focus of each case was an actual decision that needed to be made by a case protagonist. The presentation of the background needed to understand the case context required considerable depth, with the average case length being over 25 book pages. In the classroom, each case was used as the basis of a discussion that typically took 75-90 minutes. When used online, discussions were conducted asynchronously and typically resulted in 80-100 student posts over the course of a week. The targeted learning outcome of the discussion was improved judgment when faced with complex decisions with cybersecurity implications.

The cases were organized around the NIST cybersecurity framework:

IDENTIFY

CYBER INSURANCE AT USF: An IT director at the university is tasked with determining if it makes sense for the university to acquire a cybersecurity insurance policy.

DO THE CLOUDS REALLY HAVE LIMITS?: A small business consultant has been asked to explore the feasibility of moving an organization’s proprietary training assets to the cloud so international training can be delivered more economically, particularly in the Far East. Securing their intellectual property was a major concern.

PROTECT

EXPANDING JOINT VULNERABILITY ASSESSMENT BRANCH: A firm that does red team penetration testing, principally for the government, finds itself constrained by its inability to hire personnel with the requisite network and radio-frequency skills. It considers a variety of options, constrained by the fact that its employees cannot have a criminal record.

MULTI-FACTOR AUTHENTICATION AT JAGGED PEAK: A firm that hosts a logistical and marketing platform has been asked by a client to implement multifactor authentication. It considers a variety of options and struggles with the potential unintended consequences that such an implementation could have on its other customers.

SECURING THE MUMA JOURNALS: The publisher of two new online journals considers the security implications of alternative platforms.

DETECT

EXPOSING SEXUAL PREDATORS WHO RUN MARTIAL ARTS SCHOOLS: Two martial arts enthusiasts deliberate on the application of proper cyber forensic procedures in order to catch sexual predators running or employed by martial arts studios.

EMPLOYING DYNAMIC LOGIC IN CYBERSECURITY: A mathematical physicist has developed algorithms that show considerable promise in detecting malware. He considers how to move forward, since this is not his area of specialization (or interest).

RESPOND

RELIAQUEST: BEHIND ENEMY LINES: A cybersecurity firm has to decide how to react to when client’s systems are compromised by malware.

RECOVER

GRANDON.COM GOT HACKED!: A professor’s personal website is hacked and he needs to decide how to respond.

ADDITIONAL CASES INVOLVING EDUCATING CLIENTS AND STUDENTS

THE QUEST FOR RELIABLE CYBER SECURITY: A client of a cybersecurity firm is willing to pay large fee in return for a guarantee of 100% protection. The company considers how to educate the client regarding what is realistic.

A CYBERSECURITY EXECUTIVE DBA?: The program director of a doctoral program in business for working executives considers the possibility of offering a cybersecurity concentration.

The project, originally planned for 2 years, took considerably longer than anticipated owing to the difficulty associated with finding suitable case sites. By the end of the project, 11 cases had been published individually and collectively (in book form), involving 20 different authors (including faculty, graduate students and one undergraduate), one 3-day and four 4-hour faculty workshops had been conducted, attended by more than 100 faculty members and roughly 25 graduate students. One cybersecurity course capstone course was pilot tested and plans were made to integrate a cybersecurity module using the cases into the college’s online MBA program. Individual cases were also incorporated into the college’s undergraduate and graduate Business Analytics and Information Systems programs.

With respect to intellectual merit, the project demonstrated the feasibility of developing cybersecurity cases and building a course around them, as well as using them individually as elements of other courses. It also identified the principal challenge: finding suitable sites. Its broader impacts included introducing case writing and the case discussion pedagogy to a large number of faculty and graduate students from many disciplines.

Last Modified: 09/23/2018
Modified by: T Grandon Gill