TWC SBE: Option: Small: Building Public Cyber Health - Designing and Testing the Efficacy of a School-Focused, Gamification Approach to Create a Secure Computing Environment

随着网络攻击的频率和复杂性增加，创建安全计算环境的方法必须超越从外部保护的技术障碍，从内部建立网络健康的协作文化。使用在线激励已被证明是提高个人对任务参与度的有效工具。该项目探索使用在线激励和社交网络来改善组织的网络健康状况，方法是将组织内个人的微型网络行为结合在一起，以创建更安全的计算环境。学校是测试这种网络安全新模式的理想场所。教师、教职员工和家长都积极保障学生的安全。此外，今天的大多数学生都非常精通技术，它将技术作为一种理想的手段来向学生传授网络风险以及如何避免这些风险，并在减少不良行为的同时加强良好的网络行为。该项目将学校作为一个系统，通过使用数字中介干预措施来改善和维护网络安全，这些干预措施将在线心理激励学生参与和社交网络结合在一起，以加强社会和权威人物的影响力。简而言之，该项目的总体目标是通过让多个利益攸关方参与帮助建立一个更强大的公共网络卫生系统来“建立网络安全”。通过在三个学生群体中实施的干预实验，正在探索激励措施在建立集体网络安全意识和加强积极网络行为方面的有效性：1)小学生首次在学校环境和家庭环境中接触到数字设备的监督使用；2)中学生是数字设备的“试验性”用户，对网络安全概念的认识有限；以及3)大学生表现出危险的网络行为，这些行为往往会将他们和其他大学利益相关者置于危险之中。最近，以学校为基础的公共卫生干预措施在改变个人健康行为方面取得了成功，这为该项目建设公共网络健康的方法提供了信息。特别是，众所周知的健康信念模型提供了一个镜头，用于探索个人在决定是否采取该行为时，如何在相信自己对网络威胁的敏感性与相信拟议的缓解行为的有效性之间取得平衡。然而，公共卫生和网络安全之间存在着重要的区别。特别是在公共卫生领域使用的在线激励，已被证明在改变个人已经知道自己应该做的行为和他们已经知道如何做的行为方面最有效。这项研究将探索通过数字设备提供的干预是否能够成功地改变一个人目前的危险行为，并在不同年龄段引入新的安全行为。为了评估干预措施的影响，在整个研究过程中，将使用调查和监测干预实验来收集个人网络安全知识、感知和行为的数据。如果成功，该项目开发的新型公共网络健康干预措施将为雇用参与学生的企业、采用干预技术的其他组织以及更广泛的网络社区提供长期级联的好处。在短期内，该项目将通过改善学生参与者的网络安全知识、感知和行为，从而降低他们的风险，从而直接造福于学生参与者以及教师和家长。此后，开发的技术将广泛应用于其他学校和组织，随着个人变得更加安全，该项目的影响有可能因参与者在组织环境之外的安全行为而进一步放大。此外，这项研究针对的是特定的高危人群？参与研究的两个学生群体为我们的研究提供了独特的挑战，如果我们的研究成功，还会获得独特的回报。小学人口将来自北卡罗来纳州的一所特许学校，该学校完全由面临重大社会、经济和教育挑战的少数族裔青年组成。这家中学的合作伙伴位于经济困难的北卡罗来纳州东部的一个农村地区，它正在努力提供学生在更广泛的全球经济中取得成功所需的技术技能。

As the frequency and complexity of cyber attacks increase, approaches to create secure computing environments must look beyond technical barriers that protect from the outside to building a collaborative culture of cyber health from the inside. Use of online incentives have been shown to be an effective tool for enhancing an individual's engagement with a task. This project explores the use of online incentives and social networking to improve an organization's cyber health by coalescing the micro cyber behaviors of individuals within the organization to create a more secure computing environment. Schools represent an ideal setting in which to test such a new model for cybersecurity. Teachers, faculty and parents are motivated to keep students safe and secure. Further, most students today are very technologically savvy, which introduces technology as an ideal means by which to teach students about cyber risks and how to avoid those risks--and to reinforce good cyber behaviors while reducing bad behaviors. This project approaches the school as a system in which cybersecurity is improved and maintained through the use of digitally-mediated interventions that combine online psychological incentives for student engagement and social networking to reinforce social and authority figure influences. In short, the project broadly aims to "build cybersecurity in" by engaging multiple stakeholders to help build a more robust public cyber health system. The effectiveness of incentives in building collective cybersecurity awareness and reinforcing positive cyber behaviors is being explored through intervention experiments that are implemented in three student populations: 1) elementary school students who are being exposed to supervised use of digital devices, both in a school environment and at home, for the first time; 2) middle school students who are "experimental" users of digital devices and have limited awareness of cybersecurity concepts; and 3) college students who have been shown to demonstrate risky cyber behaviors that often put them and other university stakeholders at risk. Recent success in school-based public health interventions to modify personal health behavior informs the project's approach to building public cyber health. In particular, the well-known Health Belief Model provides a lens for exploring how individuals balance belief in their susceptibility to a cyber threat against their belief in the effectiveness of the proposed mitigating behavior when deciding whether to adopt that behavior. However, there are important differences between public health and cybersecurity. Online incentives, used in public health in particular, have been shown to be most effective in modifying behaviors that individuals already know they should perform and that they already know how to perform. This research will explore whether interventions delivered through digital devices can be successful in both changing an individual's current risky behavior and introducing new safe behaviors, at various ages. To assess the impact of the interventions, throughout the study data will be collected on individuals' cybersecurity knowledge, perceptions and behaviors using surveys and by monitoring intervention experiments. If successful, the novel public cyber health interventions developed in this project will provide benefits that cascade over the long-term to businesses that hire participating students, additional organizations that adopt the intervention techniques, and the broader cyber community. In the near term, this project will directly benefit student participants, as well as teachers and parents, by improving their cybersecurity knowledge, perceptions, and behaviors, thus reducing their risks. Thereafter, the techniques developed will be made widely available for use by other schools and organizations, and as individuals become more secure, the project's impacts have the potential to be further amplified by participants' security behaviors outside of the organizational environment. Further, specific at-risk groups are being targeted in the study?two of the student populations participating provide unique challenges to our research as well as unique rewards if our research is successful. The elementary school population will be drawn from a charter school composed exclusively of minority youth in North Carolina that face significant social, economic, and educational challenges. The middle school partner, located in a rural, economically-challenged eastern North Carolina, is struggling to provide the technical skills that its students need to succeed in the wider global economy.