We surveyed 85 experts in cybersecurity to identify common  misconceptions held by novices in cybersecurity (e.g., recent CS graduates). Each expert answered questions about misconceptions in six areas of cybersecurity and a 7th "catch-all" area. Then, with the help of eight security education researchers, the team created a codebook of common themes and identified the most frequent misconceptions in the data.

We identified approximately 100 distinct misconceptions as identified by our experts. Examples of specific frequent misconceptions include that:

• assumptions can be safely made about security
• you do not need to think adversarially about people or systems
• physical security is easy to get right
• encryption hides everything sensitive about a plaintext
• a "least privilege" policy is not required for security
• only the encryption algorithm matters, not details of its use
• writing your own encryption is a good idea
• security is a technical problem requiring only technical solutions
• online tracking is not extensive enough to reduce privacy
• confidentiality and privacy are the same thing
• security has permanent solutions
• security is binary -- you have it or you don't

Seven frequently-appearing groups of misconceptions appeared when the data was analyzed, including the belief that 1) cryptography is more powerful than it is in reality, 2) people and systems can be trusted to operate as expected (failing to think adversarially), 3) security controls are effective and correct, 4) allowing unnecessary privileges is a safe practiceg, 5) most users and systems are not targets for cyberattacks, 6) data can be perfectly and safely anonymized while remaining useful, and 7) physical security is not critical for cybersecurity.

We then created a multiple-choice test for these misconceptions by asking students open-ended questions probing discrete misconceptions within each category. Next, we took students' most frequent wrong answers and created a multiple-choice "mis-concept inventory" intended to help identify the misconceptions that students hold, so that instructors can identify gaps in knowledge and remediate the specific misconceptions in question. This test will be validated and made freely available to qualified instructors / practitioners. (Validation requires testing with a large number of subjects and statistical analysis and was not part of the original scope of the project.)

To help instructors teach students the correct concepts underlying these ideas, we created hands-on, interactive, active learning exercises that students can access using a web browser from anywhere. Each exercise features reading material discussing the misconception and its correct counterpart followed by a web-based interactive demonstration or exploration of the issue that shows the outcomes of the misconception. Activities also include a comprehension quiz.

These exercises include:

• A game showing how systems with one layer of defense will be compromised when that one defense fails (controls are not perfect)
• A funny demonstration where users can instruct a sci-fi robot to make impossible or dangerous recipes, demonstrating why testing the validity of input is critical for security (adversarial thinking)
• An exercise that demonstrates how crypto.graphy does not hide or protect everything about data (cryptography)
• An exercise where students find weaknesses in access control systems (privileges & access control)
• An interactive demonstration showing how randomized attacks result in virtually all vulnerable machines getting compromised (everyone is a target)
• An exercise where students de-anonymize subjects in a fictional data set by cross-referencing anonymized data with public data (privacy and anonymity)
• An interactive fiction game where students explore how physical security is both essential and difficult to get right (physical security)

For example, in the physical security activity, students first read about classic issues in physical security and why it underpins almost all cybersecurity. Then, they take on the role of a thief in a retro-themed "text adventure" who is in an office after hours with a list of electronic items to steal from a business. The player must explore the small, self-contained office in order to figure out how to break the existing physical security mechanisms. At the same time, players learn first-hand -- through game actions --  how physical access to computers often gives an attacker tremendous privileges that software and hardware defenses cannot mitigate. These exercises and some accompanying videos will be available at https://lars.d.umn.edu/misconceptions/ in early 2023.

Our hope is that this work will enable instructors and practitioners to have robust understanding of some of the critical and pernicious misconceptions surrounding cybersecurity, and that this will result in better education and stronger security for our country and world.

Last Modified: 12/22/2022
Modified by: Peter A Peterson