Technology and Innovation Commons^™

Social Media Platforms And Responsibility For Disinformation, Matt T. Figlia, Brandon M. Henschen, Joseph T. Sims, John-David Rusk

KSU Proceedings on Cybersecurity Education, Research and Practice

Researchers are paying closer attention to the rise of disinformation on social media platforms and what responsibility, if any, the companies that control these platforms have for false information being spread on their websites. In this paper, we highlight the recent growth in concern regarding online disinformation, discuss other works regarding the use of social media as a tool for spreading disinformation, and discuss how coordinated disinformation campaigns on social media platforms are used to spread propaganda and lies about current political events. We also evaluate the reactions of social media platforms in combatting disinformation and the difficulty in policing …

Towards Assessing Organizational Cybersecurity Risks Via Remote Workers’ Cyberslacking And Their Computer Security Posture, Ariel Luna, Yair Levy, Gregory Simco, Wei Li

KSU Proceedings on Cybersecurity Education, Research and Practice

Cyberslacking is conducted by employees who are using their companies’ equipment and network for personal purposes instead of performing their work duties during work hours. Cyberslacking has a significant adverse effect on overall employee productivity, however, recently, due to COVID19 pandemic move to remote working also pose a cybersecurity risk to organizations networks and infrastructure. In this work-in-progress research study, we are developing, validating, and will empirically test taxonomy to assess an organization’s remote workers’ risk level of cybersecurity threats. This study includes a three-phased developmental approach in developing the Remote Worker Cyberslacking Security Risk Taxonomy. With feedback from cybersecurity …

Nids In Airgapped Lans--Does It Matter?, Winston Messer

KSU Proceedings on Cybersecurity Education, Research and Practice

This paper presents an assessment of the methods and benefits of adding network intrusion detection systems (NIDS) to certain high-security airgapped isolated local area networks. The proposed network architecture was empirically tested via a series of simulated network attacks on a virtualized network. The results show an improvement of double the chances of an analyst receiving a specific, appropriately-severe alert when NIDS is implemented alongside host-based measures when compared to host-based measures alone. Further, the inclusion of NIDS increased the likelihood of the analyst receiving a high-severity alert in response to the simulated attack attempt by four times when compared …

What You See Is Not What You Know: Deepfake Image Manipulation, Cathryn Allen, Bryson Payne, Tamirat Abegaz, Chuck Robertson

KSU Proceedings on Cybersecurity Education, Research and Practice

Research indicates that deceitful videos tend to spread rapidly online and influence people’s opinions and ideas. Because of this, video misinformation via deepfake video manipulation poses a significant online threat. This study aims to discover what factors can influence viewers’ capability of distinguishing deepfake videos from genuine video footage. This work focuses on exploring deepfake videos’ potential use for deception and misinformation by exploring people’s ability to determine whether videos are deepfakes in a survey consisting of deepfake videos and original unedited videos. The participants viewed a set of four videos and were asked to judge whether the videos shown …

Editors' Preface, Michael E. Whitman, Herbert J. Mattord, Hossain Shahriar

KSU Proceedings on Cybersecurity Education, Research and Practice

Since 2004, Kennesaw State University, Georgia, has hosted an academic conference. Over the years, the event has brought together hundreds of faculty and students from throughout the U.S., sharing research into pedagogical efforts and instructional innovations. Initially, the conference was named the Information Security Curriculum Development conference and served as KSU’s contribution to engage our colleagues in growing security education from its infancy. It was paired with KSU’s inaugural security education journal, the Information Security Education Journal. In 2016, the event was rebranded as the Conference on Cybersecurity Education, Research, and Practice to reflect both an expansion of topics suitable …

Principles Of Information Security, Alison Hedrick

KSU Distinguished Course Repository

An introduction to the various technical and administrative aspects of Information Security and Assurance. This course provides the foundation for understanding the key issues associated with protecting information assets, determining the levels of protection and response to security incidents, and designing a consistent, reasonable information security system, with appropriate intrusion detection and reporting features.

Security Issues With Software In Maritime Industry: Focus On Artificial Intelligence, Alexis Nixon

Graduate Scholarly Works

Abstract

Maritime industry is the use of waterways to conduct business, move people and goods across water and shipping goods overseas. This area of business is last to update their cyber security and technical policies leading to many issues discussed below. Some of proposed solutions include updated software, patches, autonomous ships and updating the legality issues around technical updates in Maritime industry. Overall, the goal of the paper is to help the reader become informed about the shortcomings in maritime software, understand the vulnerabilities in the software they use, propose solutions to the vulnerabilities and discuss a popular new option …

Factors That Influence The Implementation Of Information And Communication Technology Inclusive Design Practices In Organisations, Faizel Ebrahim, Salah Kabanda, Guidance Mthwazi

African Conference on Information Systems and Technology

Inclusive design in information and communication technology (ICT) is the development of information and communication technology artifacts that are accessible and easy to use for as many people as possible. Human diversities must be considered when producing these inclusive design artifacts. It is not only important for abled people but also extends to people with disabilities, the elderly and anybody challenged with using these artifacts. Yet, few designers and developers adopt inclusive design methodologies in their practice. This study seeks to identify and understand the factors that influence the implementation of inclusive design practices in organisations. The methodology was based …

Privacy Rights Pertaining To The Developing Cyber World We Live In, Alexis Nixon

Graduate Scholarly Works

A large concern expressed by the general public is the right to privacy when dealing with the cyber/online sector. One major factor that influences the privacy rights of people in the cyber realm is our fourth amendment in the United States. In this paper, the focus will be on the fourth amendment, privacy rights and how these pertain to the cyber world of individuals, companies and countries. Some of the points covered in the sections below include: an explanation of the fourth amendment, influential court case pertaining to the fourth amendment, companies right to privacy/ keeping their customers data private, …

Cybersecurity Educational Resources For K-12, Debra Bowen, James Jaurez, Nancy Jones, William Reid, Christopher Simpson

Journal of Cybersecurity Education, Research and Practice

There are many resources to guide successful K-12 cybersecurity education. The objective of these resources is to prepare skilled and ethical cybersecurity students at the earliest level to meet the demands of higher-level programs. The goal of this article is to provide, as a starting point, a list of as many currently popular K-12 educational resources as possible. The resources provided are broken into five categories: 1) Career Information, 2) Curriculum, 3) Competitions, 4) CyberCamps, and 5) Labs and Gaming. Each resource listed has a link, the K-12 levels that are supported, whether the resource is free or has a …

Digital Contact Tracing And Privacy, Mahdi Nasereddin, Edward J. Glantz, Galen A. Grimes, Joanne Peca, Michelle Gordon, Mike Bartolacci

Journal of Cybersecurity Education, Research and Practice

Digital contact tracing tools were developed to decrease the spread of COVID-19 by supplementing traditional manual methods. Although these tools have great potential, they were developed rather quickly resulting in tools with varying levels of success. The main issues with these tools are over privacy and who might have access to the information gathered. In general, their effectiveness varied globally, where users expressed privacy concerns associated with sharing identity, illness, and location information. This paper reviews these issues in deployments across Asia, Europe, and the United States. The goal is to begin a discussion that improves the design and development …

Security Simulations In Undergraduate Education: A Review, Joseph Simpson, Aaron Brantly

Journal of Cybersecurity Education, Research and Practice

Several decades of research in simulation and gamification in higher education shows that simulations are highly effective in improving a range of outcomes for students including declarative knowledge and interest in the topic being taught. While there appears to be a broad array of options to provide education in an undergraduate setting related to security, no previous reviews have explored computer-based simulations covering all facets of security. Given the increasing importance and adoption of interdisciplinary educational programs, it is important to take stock of simulations as a tool to broaden the range of problems, perspectives, and solutions presented to students. …

Assessing The Practical Cybersecurity Skills Gained Through Criminal Justice Academic Programs To Benefit Security Operations Centers (Socs), Lucy Tsado, Jung Seob "Scott" Kim

Journal of Cybersecurity Education, Research and Practice

Private-sector and public-sector organizations have increasingly built specific business units for securing company assets, reputation, and lives, known as security operations centers (SOCs). Depending on the organization, these centers may also be referred to as global security operations centers, cybersecurity operations centers, fusion centers, and corporate command centers, among many other names. The concept of centralized function within an organization to improve an organization’s security posture has attracted both the government and the private sectors to either build their own SOCs or hire third-party SOC companies.

In this article, the need for a multidisciplinary approach to cybersecurity education at colleges …

Editorial, Michael E. Whitman, Herbert J. Mattord, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

Since 2016, it has been the mission of the Journal of Cybersecurity Education, Research, and Practice (JCERP) to be a premier outlet for high-quality information security and cybersecurity-related articles of interest to teaching faculty and students. This is the 12^th edition of the (JCERP) and, as ever, we are seeking authors who produce high-quality research and practice-oriented articles focused on the development and delivery of information security and cybersecurity curriculum, innovation in applied scholarship, and industry best practices in information security and cybersecurity in the enterprise for double-blind review and publication. The journal invites submissions on Information Security, Cybersecurity, …

Digital Transformation: Implementing 3d Printing Activities Into Core Business Classes, Shota Yasuda, Rohit Gibson, Will Smith, Beau Wilkins, Blair Dilbeck, Jamari Baker

Symposium of Student Scholars

The business college’s new 3D lab, launched in August 2021, has been providing 3D design and 3D printing workshops for core business classes, specifically IS 2200 and IS 3100, to allow students to experiment with additive manufacturing, more commonly known as 3D printing. In the age of digital transformation, it is more important than ever that business school graduates are exposed to these emerging technologies, learn from experimentation, and develop a foundational understanding of these technologies so that they are better prepared to innovate and lead once they have graduated.

The idea of the 3D printing workshops is that a …

Online Fraud By Way Of Phishing Emails, Alexis Nixon

Graduate Scholarly Works

With the rise of people using the Internet more since Covid-19 started, there has been an increase in fraud cases that occur on the internet as well. Some of these frauds occur by way of romance scams, inauthentic products or even investment fraud. The single type of fraud that was researched and discussed below is the use of phishing emails to commit fraud. Here the perpetrator sends out the same email in a mass quantity, with hopes of getting as many people to fall victim to as possible. The email usually looks like it is legitimate and coming from your …

Experimental Study To Assess The Impact Of Timers On User Susceptibility To Phishing Attacks, Amy E. Antonucci, Yair Levy, Laurie P. Dringus, Martha Snyder

Journal of Cybersecurity Education, Research and Practice

Social engineering costs organizations billions of dollars. It exploits the weakest link of information systems security, the users. It is well-documented in literature that users continue to click on phishing emails costing them and their employers significant monetary resources and data loss. Training does not appear to mitigate the effects of phishing much; other solutions are warranted. Kahneman introduced the concepts of System-One and System-Two thinking. System-One is a quick, instinctual decision-making process, while System-Two is a process by which humans use a slow, logical, and is easily disrupted. The key aim of our experimental field study was to investigate …

Faculty And Advisor Advice For Cybersecurity Students: Liberal Arts, Interdisciplinarity, Experience, Lifelong Learning, Technical Skills, And Hard Work, Brian K. Payne, Bria Cross, Tancy Vandecar-Burdin

Journal of Cybersecurity Education, Research and Practice

The value of academic advising has been increasingly emphasized in higher education. In this study, attention is given to the most significant types of advice that a sample of cybersecurity faculty and advisors from the Commonwealth of Virginia recommend giving to cybersecurity students. The results show that faculty and advisors recommended that students be aware of six different aspects of cybersecurity education including the value of experience, the need for lifelong learning, the importance of hard work, the need to develop technical skills, the interdisciplinary nature of cybersecurity, and the need to develop liberal arts or professional/soft skills. Implications of …

Subject Matter Experts’ Feedback On Experimental Procedures To Measure User’S Judgment Errors In Social Engineering Attacks, Tommy Pollock, Yair Levy, Wei Li, Ajoy Kumar

Journal of Cybersecurity Education, Research and Practice

Distracted users can fail to correctly distinguish the differences between legitimate and malicious emails or search engine results. Mobile phone users can have a more challenging time identifying malicious content due to the smaller screen size and the limited security features in mobile phone applications. Thus, the main goal of this research study was to design, develop, and validate a set of field experiments to assess user’s judgment when exposed to two types of simulated social engineering attacks: phishing and Potentially Malicious Search Engine Results (PMSER), based on the interaction of the environment (distracting vs. non-distracting) and type of device …

A Taxonomy Of Cyberattacks Against Critical Infrastructure, Miloslava Plachkinova, Ace Vo

Journal of Cybersecurity Education, Research and Practice

The current study proposes a taxonomy to organize existing knowledge on cybercrimes against critical infrastructure such as power plants, water treatment facilities, dams, and nuclear facilities. Routine Activity Theory is used to inform a three-dimensional taxonomy with the following dimensions: hacker motivation (likely offender), cyber, physical, and cyber-physical components of any cyber-physical system (suitable target), and security (capable guardian). The focus of the study is to develop and evaluate the classification tool using Design Science Research (DSR) methodology. Publicly available data was used to evaluate the utility and usability of the proposed artifact by exploring three possible scenarios – Stuxnet, …

The 2020 Twitter Hack – So Many Lessons To Be Learned, Paul D. Witman, Scott Mackelprang

Journal of Cybersecurity Education, Research and Practice

In mid-July 2020, the social media site Twitter had over 100 of its most prominent user accounts start to tweet requests to send Bitcoin to specified Bitcoin wallets. The requests promised that the Bitcoin senders would receive their money back doubled, as a gesture of charity amidst the COVID-19 pandemic. The attack appears to have been carried out by a small group of hackers, leveraging social engineering to get access to internal Twitter support tools. These tools allowed the hackers to gain full control of the high-profile user accounts and post messages on their behalf. The attack provides many paths …

Editorial Vol 2021, No 2, Herbert J. Mattord, Michael E. Whitman, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

Welcome to the Winter 2021 edition of the Journal for Cybersecurity Education, Research, and Practice.

How Social Media And Internet Links To Hate Speech, Cyber Bullying, And Defiance/Cybercrime In Youth, Alexis Nixon

Graduate Scholarly Works

Over the past 20 years or so there has been an increase in technological advancements and more people gaining access to the internet. While these advancements have been helpful in the everyday functions of life, they also bring with them some negative effects (Brady et al., 2015). One of the most vulnerable groups to fall victim to the negative effects of technology and social media are the youth but more specifically the teenagers in middle and high school. In the following essay, there has been research done to explain the societal impacts of cybercrime/deviance on teens, online hate speech and …

The Impact Of A Gencyber Camp On In-Service Teachers’ Tpack, Kevin M. Thomas, Jessica Ivy, Kristin Cook, Robert R. Kelley

Journal of Cybersecurity Education, Research and Practice

The purpose of this study was to examine the impact of a GenCyber camp curriculum on teachers’ technology, pedagogy, and content knowledge (TPACK). The camp was designed to engage participants in developing the knowledge and skills to incorporate GenCyber Cybersecurity First Principles and GenCyber Cybersecurity Concepts (GenCyber, 2019) into their curriculums. Participants (37 middle and high school teachers from a variety of disciplines) attended one of two weeklong camps held at a Midwestern liberal arts university. Using the TPACK Self-Reflection and TPACK Self-Assessment Surveys, pre- and post-camp data were collected from participants. Findings indicate that participants demonstrated an increase in …

Toward A Student-Ready Cybersecurity Program: Findings From A Survey Of Stem-Students, Lora Pitman, Brian K. Payne, Tancy Vandecar-Burdin, Lenora Thorbjornsen

Journal of Cybersecurity Education, Research and Practice

As the number of available cybersecurity jobs continues to grow, colleges strive to offer to their cybersecurity students an environment which will make them sufficiently prepared to enter the workforce after graduation. This paper explores the academic and professional needs of STEM-students in various higher education institutions across Virginia and how cybersecurity programs can cater to these needs. It also seeks to propose an evidence-based approach for improving the existing cybersecurity programs so that they can become more inclusive and student-ready. A survey of 251 college students in four higher-education institutions in Virginia showed that while there are common patterns …

Editorial, Michael E. Whitman, Herbert J. Mattord, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

Since 2016, it has been the mission of the Journal of Cybersecurity Education, Research, and Practice (JCERP) to be a premier outlet for high-quality information security and cybersecurity-related articles of interest to teaching faculty and students. This is the 13^th edition of the (JCERP) and, as ever, we are seeking authors who produce high-quality research and practice-oriented articles focused on the development and delivery of information security and cybersecurity curriculum, innovation in applied scholarship, and industry best practices in information security and cybersecurity in the enterprise for double-blind review and publication. The journal invites submissions on Information Security, Cybersecurity, …

Government Workspace Digitalization And Socioeconomic Development Outcomes In Ghana, Winfred Ofoe Larkotey, John Effah, Richard Boateng

The African Journal of Information Systems

The study sought to understand how the structurational environment shapes socioeconomic outcomes of government workspace digitalization in Ghana based on a qualitative, interpretive case study and the structurational model of technology as a theoretical lens. The findings show how the availability of electronic transactions law, government borrowing, and extendable system design can positively influence socioeconomic outcomes of government workspace digitalization. However, use of multiple system development environments, bureaucracy, a within-country digital divide, and a persistent physical signature and letterhead culture can negatively influence the socioeconomic development goals of government workspace digitalization.

Emotional Analysis Of Learning Cybersecurity With Games Using Iot, Maria Valero, Md Jobair Hossain, Shahriar Sobhan

KSU Proceedings on Cybersecurity Education, Research and Practice

The constant rise of cyber-attacks poses an increasing demand for more qualified people with cybersecurity knowledge. Games have emerged as a well-fitted technology to engage users in learning processes. In this paper, we analyze the emotional parameters of people while learning cybersecurity through computer games. The data are gathered using a non-invasive Brain-Computer Interface (BCI) to study the signals directly from the users’ brains. We analyze six performance metrics (engagement, focus, excitement, stress, relaxation, and interest) of 12 users while playing computer games to measure the effectiveness of the games to attract the attention of the participants. Results show participants …

Resilience Vs. Prevention. Which Is The Better Cybersecurity Practice?, Frank Katz

KSU Proceedings on Cybersecurity Education, Research and Practice

Students in multiple cohorts of our 3000 level Fundamentals of Information Systems Security course were given a discussion question where they had to either agree or disagree with the premise that given all the constant threats to our systems, we should dedicate more of our efforts to quickly repairing the damage of an attack rather than dedicate more of our time and energies to preventing such attacks. They were required to give their reasoning and provide sources to back up their analysis of his comment.

This paper will describe and explain the concept of cyber resiliency. It will then evaluate …

Warshipping: Hacking The Mailroom, Jackson Szwast, Bryson Payne

KSU Proceedings on Cybersecurity Education, Research and Practice

Everyone knows what package shipping is, but not everyone knows what warshipping is. Corporate mailrooms are rarely considered as part of the cybersecurity attack surface of most organizations, but they offer physical access to millions of uninspected packages daily. UPS shipped 5.5 billion items last year, with their daily average being 21.9 million items and operating through 1,800 locations in 2020. FedEx shipped 6.5 million packages daily and operates 2,150 locations. The United States Postal Service delivered 143 billion pieces of mail in 2019. Increasingly the world’s consumers are relying on e-commerce, and during the recent COVID-19 pandemic, package deliveries …