Cybersecurity: Exploring core concepts through six scenarios. Issue 4 (4th July 2018)

• Record Type: Journal Article
• Authors: Sherman, Alan T.; DeLatte, David; Neary, Michael; Oliva, Linda; Phatak, Dhananjay; Scheponik, Travis; Herman, Geoffrey L.; Thompson, Julia
• Is Part Of: Cryptologia. Volume 42:Issue 4(2018)
• Page Start: 337
• Page End: 377
• Publication Date: 2018-07-04
• Subjects: computer security -- Cybersecurity Assessment Tools (CATS) -- cybersecurity education -- information assurance; Cryptography -- Periodicals; 652.8
• DOI: 10.1080/01611194.2017.1362063
• Languages: English
• ISSNs: 0161-1194

Abstract

ABSTRACT: The authors introduce and explain core concepts of cybersecurity through six engaging practical scenarios. Presented as case studies, the scenarios illustrate how experts may reason through security challenges managing trust and information in the adversarial cyber world. The concepts revolve around adversarial thinking, including understanding the adversary; defining security goals; identifying targets, vulnerabilities, threats, and risks; and devising defenses. They also include dealing with confidentiality, integrity, availability (known as the "CIA triad"), authentication, key management, physical security, and social engineering. The authors hope that these scenarios will inspire students to explore this vital area more deeply. The target audience is anyone who is interested in learningabout cybersecurity, including those with little to no background in cybersecurity. This article will also interest those who teach cybersecurity and are seeking examples and structures for explaining its concepts. For students and educators, the authors include selected misconceptions they observed in student responses to scenarios. The contributions are novel educational case studies, not original technical research. The scenarios comprise responding to an e-mail about lost luggage containing specifications of a new product, delivering packages by drones, explaining a suspicious database input error, designing a corporate network that separates public and private segments, verifying compliance with the Nuclear Test Ban Treaty, and exfiltrating a USB stick from a top-secret government facility.