EAGER: Developing Cybersecurity Judgment Questionnaire for GenCyber Campers

点击翻译按钮获取中文摘要

GenCyber Initiative, co-sponsored by the National Science Foundation and the National Security Agency, started in 2014 to provide summer cybersecurity camp experiences for students and teachers at the K-12 level. In 2016, there are 135 camps involving approximate 6000 students and 1200 teachers. To help assess and achieve one of the goals of GenCyber, understanding correct and safe on-line behavior, the proposed project aims to develop an innovative tool, the Cybersecurity Judgment Questionnaire (CJQ), for assessing middle and higher school students' understanding of cybersecurity.CJQ is based on the heuristics and biases theory by Daniel Kahneman and focuses on cybersecurity judgment rather than on cybersecurity behavior or cybersecurity awareness because ordinary people's daily behavior is significantly influenced by their intuitive thinking and thus it is important to get into young cyber users' minds and compare their intuitive and rational cybersecurity thinking. The questionnaire employs the survey experiment approach that integrates the strengths of both surveys and experiments to collect data effectively and efficiently. In addition, to assess authentic cybersecurity judgment, it will use a real-life scenarios and ask young cyber users to judge the risk intuitively and rationally rather than asking participants to answer simple multiple-choice questions.The project will attempt to verify and extend Daniel Kahneman's theory of heuristics and biases in the cyberspace in general and in the cybersecurity domain in particular. It will use the scenario-based survey experiment with the factorial design to develop, validate, and test the measurement of cybersecurity judgment. The measurement provides a tool to assess cybersecurity understanding of GenCyber student campers. In addition, young cyber users can see both their specific vulnerabilities for possible cyber-attacks and their potential strengths for protecting cybersecurity.