SaTC: EDU: Educating STEM Students and Teachers about the Relevance of Social Engineering in Cyberattacks and Cybersecurity

社会工程(SE)是网络犯罪分子使用的一种技术，它使用心理操纵来获取敏感信息，并获得对受限区域或系统的未经授权的访问。2017年，近70%的美国组织经历了SE，导致运营停机和收入损失276万美元。人为因素通常被认为是网络攻击中最薄弱的一环，这使得SE成为网络安全的主要担忧。尽管SE攻击构成了重大威胁，但教育、培训和对SE作为网络犯罪工具的普遍认识很低。这是因为SE被认为超出了技术领域的范围，因此应该由其他学科来解决，包括心理学、犯罪学和社会学。工程学和计算机科学学科已经在主要以技术为重点的网络安全教育项目上投入巨资。虽然这种技术方法很重要，但由此产生的学生人数太少，太单一，无法支持我们这个依赖技术的社会所需的解决方案的全面发展。扩大和多样化学习SE的学生(以及接受SE教育的教师)将撒下更大的网，以招收最有才华的学生，并在他们进入网络安全大军时培养他们的创造潜力。此外，该项目将反映国家科学基金会在其战略规划中确定的两个方面扩大参与的承诺：(I)扩大努力，扩大代表不足的群体和所有地理区域的不同机构的参与，以及(Ii)培养一支多样化和积极参与的STEM工作人员队伍。因此，这个项目将促进多样性，并为未来的SE教育和研究开发和共享资源和可持续的工具，在一个安全、道德和有参与性的学习环境中。首先，它将通过实践课程项目和每年一次的校际SE捕获旗帜竞赛和培训活动来教育学生。其次，该项目将通过举办跨多个STEM学科的在线和面对面培训讲习班来教育教育工作者。最后，该项目将传播免费资源，如SE课程项目、数据集和用于研究和教育的分析框架。该项目还将与教学促进中心共同开发一套新的评估工具(调查和焦点小组)，以衡量学生和教育工作者针对SE的学习情况。该项目计划通过在人口结构各不相同的美国社区学院和大学招聘多个STEM学科来扩大学生和教育工作者的人才库并使之多样化。少数族裔服务机构、历史上的黑人学院和大学以及军队/退伍军人友好学校将特别参与。此外，项目团队将积极寻求属于这些机构中代表性不足群体的教职员工参与。这个项目得到了安全和值得信赖的网络空间(SATC)计划的支持，该计划为解决网络安全和隐私问题的提案提供资金，在这种情况下，特别是网络安全教育。SATC计划与联邦网络安全研究和发展战略计划和国家隐私研究战略保持一致，以保护和维护网络系统日益增长的社会和经济效益，同时确保安全和隐私。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Social engineering (SE) is a technique employed by cybercriminals that uses psychological manipulation to obtain sensitive information and gain unauthorized access to restricted areas or systems. Nearly 70% of U.S. organizations experienced SE in 2017, resulting in a $2.76 million loss in operational downtime and revenues. The human factor is often regarded as the weakest link in cyberattacks, making SE a major concern for cybersecurity. Despite the significant threat posed by SE attacks, education, training and general awareness of SE as a tool for cybercrime is low. This is because SE is considered to be outside the scope of the technical domain and thus should be addressed by other disciplines, including psychology, criminology, and sociology. The engineering and computer science disciplines are already investing heavily in cybersecurity education programs that have a primarily technical focus. While this technical approach is important, the resulting pool of students is too small and homogeneous to support the holistic development of the solutions needed by our technologically dependent society. Enlarging and diversifying the pool of students learning about (and teachers educating on) SE will cast a wider net to recruit the most talented students as well as fostering their creative potential as they enter the cybersecurity workforce. Furthermore, the project will reflect the National Science Foundation’s commitment to broadening participation along two fronts identified in its Strategic Plan: (i) Expanding efforts to broaden participation from underrepresented groups and diverse institutions across all geographical regions, and (ii) Preparing a diverse and engaged STEM workforce. Thus, this project will promote diversity, and develop and share resources and sustainable tools for future SE education and research in a safe, ethical, and engaging learning environment.This project has three objectives. First, it will educate students via hands-on course projects and a yearly intercollegiate SE Capture the Flag competition and training event. Second, the project will educate educators by hosting online and in-person training workshops across multiple STEM disciplines. Finally, the project will disseminate free resources such as SE course projects, datasets and analytic frameworks for research and education. The project will also develop a new set of assessment tools (surveys and focus groups) with the Center for the Advancement of Teaching to measure student and educator learning specific to SE. This project proposes to enlarge and diversify the pool of students and educators by recruiting across multiple STEM disciplines at community colleges and universities in the U.S. with varying demographics. Minority serving institutions, historically black colleges and universities, and military/veteran friendly schools will be specifically engaged. In addition, the project team will actively seek participation from faculty belonging to underrepresented groups at these institutions. This project is supported by the Secure and Trustworthy Cyberspace (SaTC) program, which funds proposals that address cybersecurity and privacy, and in this case specifically cybersecurity education. The SaTC program aligns with the Federal Cybersecurity Research and Development Strategic Plan and the National Privacy Research Strategy to protect and preserve the growing social and economic benefits of cyber systems while ensuring security and privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.