# Reaching Today's Information Security Students

Helen Armstrong, Ron Dodge, Colin Armstrong

► To cite this version:

Helen Armstrong, Ron Dodge, Colin Armstrong. Reaching Today's Information Security Students. 8th World Conference on Information Security Education (WISE), Jul 2009, Bento Gonçalves, Brazil. pp.218-225, 10.1007/978-3-642-39377-8_25. hal-01463639

HAL Id: hal-01463639

https://inria.hal.science/hal-01463639

Submitted on 9 Feb 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Reaching today's Information Security students

Helen Armstrong¹, Ron Dodge², and Colin Armstrong³

¹ School of IS, Curtin University of Technology, Australia, h.armstrong@curtin.edu.au

² IETD, USMA, West Point, New York, USA, Ronald.dodge@usma.edu

³ School of IS, Curtin University of Technology, Australia, colinarmstrong@gailaad.com

**Abstract:** Classes at university today comprise students from the Baby Boomers, Generation X and Y. The different outlooks on life of these generations affect their choice of education options and their learning preferences. There are numerous ways academics can innovatively deliver Information Security learning materials that meet the needs of these generations, whilst still achieving the educational goals. This paper discusses some observations of students in the different generations in information security courses and methods that may be used to ensure a more meaningful learning experience for both the teacher and the learner.

**Keywords:** information security education, Generation X Y, Net Generation

## 1. Introduction

Information Security approaches and techniques are constantly shifting and new approaches emerge as technology progresses and society changes. It is important to continually update information security teaching and learning methods as well as the content of education and training in line with these new directions. However, education encompasses both teaching and learning and methods of achieving the learning objectives must be sufficiently flexible to cope with a changing body of learners. We, as information security educators need to be cognizant of the characteristics of the students we teach, as well as being aware of the different learning styles of different generations. This paper describes the characteristics of our current student body and discusses pedagogical requirements to best engage them. We then present some methods by which academics teaching information security at tertiary level can make the learning experience both meaningful and fun for the learner
## 2. Characteristics of the Generations

Three main generations are represented in our information security student body today: Baby Boomers, Generation X and Generation Y. It is very easy to assume that all students born within a particular time frame will exhibit characteristics of their stylized generation and the authors are aware that this is not always the case – each student is an individual and they cannot all be the same, however they will have values and traits in common due to their shared social and historical experiences. The characteristics discussed in this paper are general and as such can only be used as a guide. It should be noted that the years forming the boundaries of each generation differs slightly between authors. It is also important to consider that some students will sit on the cusp between generations and may thus exhibit traits of more than one generation.

### 2.1 Baby Boomers

Baby Boomers were born during the period 1946-1954, just after WWII. They are confident of themselves and distrustful of authority, questioning the relevance of social structures. Their numbers are great, due to the increase in births encouraged to build the population after the two world wars. Demographics show a greater number of women than men, and the emergence of the quest for equality of the two sexes took a turn in favor of the females. Most families needed to have two incomes in order to survive and progress, initiating the concept of the 'latch-key child'. Baby boomers sought a college education, resulting in a boom in the tertiary education sector. Examples are Richard Branson, the entrepreneur who established the Virgin group of companies, and Bill Gates of Microsoft. Baby boomers are also familiar and comfortable with technology and computers.

Baby boomers see the instantaneous list of results from an Internet search engine an improvement on the extended time previously required to gather and analyze information from disparate sources. The lecture was the most efficient and cost effective means of getting information to a large number of students. The reading of books, analyses of the information gathered and then determination of the relevance of the information gathered, were necessary steps in the learning process. These are the oldest group of students in our classrooms, now being 55 to 63 years old. In many cases these students are attending to gain specialized skills and knowledge, driven by the need for qualifications for promotion or new employment. A small number are there for just the learning experience. These street-wise students bring a wealth of experience and knowledge into the classroom. On the downside, this generation can also be staid in their ways, believing that their way is the only way.
## 2.2 Generation X and Y

Generation X was born in the period between about 1965 and 1980. Gen Xers have been described by the media as practical skeptics and entrepreneurial free agents who fueled the dot-com boom [1]. Xers have also been called the MTV generation due to their short attention span. They are emotionally secure, informal, and have distain for corporate politics and bureaucracy, and company loyalty holds less importance than to Baby Boomers. Nagle suggests this generation saw their workaholic parents downsized and restructured out of their chosen careers [2]. Although Gen Xers view work as something they have to do to live (but not to define their life) they will work hard for something they believe in, something that challenges them, or something that will build new desirable skills. Currently aged between about 30 and 45, Gen Xers return to college primarily to complete unfinished business, for career advancement, career security, a career change, or to pursue hopes and dreams [3]. Examples of well known Gen Xers are Nicole Kidman and Heath Ledger.

Generation Y students were born between the mid 1970's and 2001, with Baby Boomer and Gen Xer parents. This group is accustomed to constant change. Also known as Millennials these students first appeared on campuses near the turn of the millennium. They are sometimes called the *trophy generation* as each one is recognized for participating and everyone gets a trophy. They 'graduate' from all levels of schooling including kindergarten. They are achievement oriented, very technically savvy and want to make an immediate impact with little effort. Each child is recognized as 'special' with individual wants and needs, to which custom-designed solutions are applied. They are team players and are socially aware, with a desire to solve society's problems. Millennials see colleagues as a resource for tapping for important and influential information rather than investigating and finding out via their own research efforts. They harness new social technology to the maximum, constantly time sharing across a number of electronic forums such as email, FaceBook and MySpace whilst attending to other tasks. They have a fundamental need for structure from within and without for guidance [2], preferring small goals with tight deadlines and seek to be guided, and advised of, all boundaries so as not to waste time. They seek to add as much to their portfolio as they can. Breadth is more important than depth and the journey is only a means to get to their destination [4]. They move quickly on to the next task. This group expects instant gratification because their needs have always been met immediately. Examples of this generation are Paris Hilton and Brittany Spears.

## 2.4 Post Modern Students

The majority of American students in Generations X and Y with normal media exposure have postmodern social characteristics [5]. These characteristics include: a leveled view of authority and the importance of their own opinion, belief that
experience is more important than knowledge, avoidance of pursuit for deeper meanings, preference for passiveness, and a consumer orientation to almost everything. Conflict is likely to arise in situations where current teaching methods and curricula are predominantly modernist as is the case in many universities [5]. As our student body today is comprised of mainly Gen Xers and Yers, academics teaching information security courses need to harness postmodern approaches to effectively educate students with the characteristics summarized in Table 1.

<table><caption>Table 1. Characteristics of Post Modern Students</caption><thead><tr><td>General</td><td>Learning Related</td></tr></thead><tbody><tr><td>Short concentration span</td><td>Desire a challenge</td></tr><tr><td>Desire individual recognition</td><td>Want to build skills quickly</td></tr><tr><td>View own opinion is important</td><td>Prefer small goals with tight deadlines</td></tr><tr><td>View the destination as more important than journey</td><td>Share information readily and use each other as a source of information</td></tr><tr><td>Passive</td><td>Prefer limits and structure, and need clear guidance</td></tr><tr><td>Desire immediate impact with little effort</td><td>Choose breadth rather than depth in researching new topics</td></tr><tr><td>Gather trophies and accolades</td><td>Only retain information deemed relevant</td></tr><tr><td>Use social technology constantly</td><td>Information needed is gathered just in time</td></tr></tbody></table>

As new students progress through their tertiary education they are required to adjust to the different expectations and learning activities associated with a higher learning environment. The need to research (rather than Google search) and think (rather than having an answer given) are features of higher learning. As the majority of tertiary learning environments are still based upon the values and beliefs of the Baby Boomer generation many new tertiary students become frustrated and withdraw from their courses. It must be borne in mind that university education is not offered to solely provide skills and training (which more closely meets the needs and expectations of these generations), but an education in its richest sense. An education encourages thinking, and research; the building of concepts and theory, and the application of such theories into practice. Many current students do not see the value in their degree studies as they are not able to convert their learning into immediate practical skills. In order to provide such an education academics need to not only manage the expectations of new students but also adjust their methods of teaching so more value is obtained by the students at the same time deeper learning takes place.

## 3. Pedagogy Approaches and Information Security

Many approaches have been postulated to engage today's college-aged students, one of which is the Postmodern Pedagogy. This approach recognizes that students require engaging experiences to fully capture their interest and encourage
learning. This is the first step in transformational or adult learning models [6]. The description of Postmodern Pedagogy in Taylor [7] identifies that the traditional student – instructor relationship is significantly different from the generations before Gen X. Students are no longer driven by a situation where they are expected to please the instructor; instead, instructors are required to compete for student enrollments as a service provider. Faculty success is measured by the pass rate of students. When a course has an exceedingly low grade average, the thought is not, “why aren’t the students learning”, it is “why is the instructor not reaching the students”. In addition to the relationship and the faculty role changing, the expectation of students is also different. Students are enrolled in Bachelor and Masters programs with a goal of post education employment. They demand applicable curriculum that will enable them to be immediately effective in their chosen career field. In the IT field, this typically involves the certification preparation where detailed technical, “hands on” skills are required.

Postmodern Pedagogy further defines methods instructors may use to construct curriculum to meet the demands of the new teaching environment. We group these into two broad categories, assessing the student's learning paradigm and constructing a learning conducive environment. In the former, instructors must identify the goals of the students and help the students realize the importance. In the latter, the learning environment must use techniques and technologies beyond lecture. Specifically called for is an increased activity in learning. Studies have concluded that experiential based curriculum strategies result in a higher degree of learning [8,9]. In IT fields, this commonly involves hands-on laboratory exercises. Material should be delivered in multiple formats and the instructor should be available via several mediums (office hours, email, SMS, and the like). Finally, the assessments used must be meaningful. For students memorizing principles and theorems holds no importance to them. We must find a way to embed them into learning goals where the assessments require the student to demonstrate an understanding of the principle – not merely repeat it.

Information security education requires that students have a fundamental understanding of many computer science foundational topics. That, however, is not enough. This knowledge must be applied against a constant changing landscape of aggressor and technology. The skillful attacker is really the kind of student that we would all like to have. He/she is engaged in hacking because they truly are engaged at the base level by a desire to assess a technology and predict how it will fail under specific circumstances (for a variety of motivations). To create and defend our systems against this motivated adversary, our students must be similarly engaged in the process. This level of learning is commonly referred to in Bloom's Taxonomy [10] as the Evaluation level. This is in conflict with the general trend of the post modern generations to understand only what is needed for short term objectives. The good news is that the requirement for information security education at colleges and universities is a relatively recent growth. Instructors are more and more coming to the task of educating with experience managing the very systems their students will be working with upon graduation.
This common understanding of the market requirements provides a link not shared in other disciplines. Although teachers in information security programs are predominantly baby boomers, and some Xers they are progressive enough to willingly adapt teaching strategies, however, more than likely they still harbor much of the “lecture” mentality they experienced in education.

## 4. Closing the Gap

Experiential learning [11], or learning by doing is very important for this generation. Engaging the student in discussions and collaborating in hands-on exercises facilitates a better understanding of the concepts and motivates the student by applying knowledge in a recognizable manner. This interaction allows them to build the skills they pursue. The goal of information security education should be to develop a learning environment where students are required to apply knowledge and seek answers from group members or other students rather than relying on teachers for the answer. When developing an information security course, faculty should consider various ways to engage the student inside and outside of lecture. Several examples utilized successfully by the authors for reducing the gap and achieving objectives in information security include:

**Experiential:** Design classes so they are practical in nature and require students to actively participate early in each class. Get students actively participating early in each session. Introduce the topic through a real world example. For example if the topic deals with social engineering use social engineering before class to demonstrate the ease at which the student would fall prey to the very topic of the lesson. Experiential learning enables students to concrete their learning and gain skills and understanding. Their concentration span can be extended as they learn and apply new concepts. Walk through practical tasks with them as the theory is being presented. For example, when teaching security policy implementation via firewall rules set the students an exercise to specify the firewall rules as the table is developed, and implement and test it. Another example is giving computer forensics students a set of screwdrivers, a couple of surplus hard drives to dismantle, and an hour to explore at their own pace provides them with insights about the technology they would not achieve by reading a text book or viewing lecture slides.

**Task Size:** Break the learning session into small tasks allocating a short burst of time for each task. Information security is very open to teaching in smaller sections, with each section or task building on previous tasks. For example students could use password cracking software to gain access to passwords, and then use more secure methods to protect passwords.

**Relevance:** Show the relevance of the pedagogical materials to the course objectives and subsequent employment. Students respond positively when they
can see the applicability and relevance of what they are learning. Understanding how security concepts apply in differing fields and situations is also helpful for students to see relevance in what they are learning. Using technologies the students know to reinforce lack of security in their Facebook and MySpace accounts brings home the need for certain security measures and an opportunity to explain how these work. Linking courses to external certification and standards also reinforces the relevance of the knowledge and skills being learned.

***Examples and Instructions:*** For more complex tasks give unambiguous, concise instructions, clearly presenting what is required of the students, and the end product they are expected to produce. This links closely to making the material relevant. The end product needs to be something where the student can come away with a more clear understanding of what the objective was and whether they achieved it. Present examples to demonstrate key points. Students should be led through basic examples and then challenged to solve more complex ones that build from in-class examples.

***Contemporary Tools:*** Use interactive media and interaction and provide multiple ways to access the material. Rich interactive media engages students and holds their interest. This content should be available in multiple formats. For lectures, the material can be recorded for "pod cast" or videotaped. Labs or exercises should be accessible from multiple endpoints. Several universities have developed technologies to enable student access from almost anywhere. Multiple formats of the learning materials also provide access to those students with disabilities. Use new technologies as teaching and learning tools, i.e. set assessments and exercises so that students can use the technologies they know, i.e. Second Life, games, etc. Use online references and sources of information. Students should be able to seek additional information when not in class. Instructors can assist by providing links to current additional references that students can use to investigate further.

***Groups:*** Undertake exercises in small groups to encourage confidence. Students are comfortable with this approach as they gather in small groups to discuss assessments and to study. Network security can be presented in such a way that students establish a small network (a virtual environment using tools such as VMWare works really well), then attack each other's networks to test robustness.

***Non-assessment:*** Set practical exercises that are not assessed. This encourages the students to participate and learn without the fear of not succeeding. For example a moot court exercise enables computer forensic students to demonstrate concepts and processes and thus be able to credit themselves with a specific set of skills without undergoing what they see as a formal academic assessment or examination.
## 5. Conclusion

Educating a mix of information security students from different generations means teachers and students need to interact in a common space. This requires an understanding of the characteristics and learning styles of each generation, plus the flexibility to adjust methods to achieve the learning objectives to the benefit of all. However, it also requires a full understanding of the learning objectives and their relevance to the world the students will enter on completion of their studies. Postmodern students respond positively to relevant and practical learning and the information security field is well placed to set these students up for success in their learning journey.

## References

1. Rickes, Persis C. 2009, Make way for millennials! How today's students are shaping higher education space, *Planning for Higher Education*, Jan-March, Vol 37, Iss 2, pp 7-17.

2. Nagle, T., 2007, *Coaching Generation X*, Retrieved January 31, 2009 from http://www.coachingandmentoring.com/Articles/x's.html

3. Black, Jim, 2003, *Gen Xers Return to College: Enrollment Strategies for a Maturing Population*, AACRAO, Washington DC

4. Howe, N. & Strauss, W., 2007, *Millenials go to College*, 2nd Edition, LifeCourse Associates, Great Falls, VA

5. Payne, S.L. & Holmes, B., 1998, Communication challenges for management faculty involving younger Generation, *Journal of Management Education*; June Vol. 22, No. 3; ABI/INFORM Global, pg. 344-367

6. Tsao, J., Takahashi, K., Olusesu, J. & Jain, S., 2006, Transformative Learning, In M. Orey (Ed.), *Emerging perspectives on learning, teaching, and technology*. Retrieved January 05, 2009, from http://projects.coe.uga.edu/epltt/

7. Taylor, M., 2006. *Generation neXt comes to college: 2006 updates and emerging issues*, Retrieved January 13, 2009 from http://www.taylorprograms.org/images/Gen_NeXt_article_HLC_06.pdf

8. Greenberg, J.E.; Delgutte, B.; Gray, M.L. 2003, Hands-on learning in biomedical signal processing, *Engineering in Medicine and Biology Magazine, IEEE*, Vol. 22, Issue 4, July-Aug, pp 71 – 79

9. Mountain, J.R, 2004, Work in progress - applied process control systems design: hands-on laboratory experiences for multiple disciplines and academic levels, *Frontiers in Education*, FIE 2004. 34th Annual, Vol. 1, ppT1D - 3-4

10. Bloom, B. S., 1956, *Taxonomy of Educational Objectives: Handbook I: Cognitive Domain*, Longmans, Green & Company

11. Kolb, D.A., 1984, *Experiential Learning: Experience as the Source of Learning and Development*, Prentice-Hall, Inc., Englewood Cliffs, N.J.