<figure><img src="image_1.png" /></figure>

HAL
open science

# Using Bloom's Taxonomy for Information Security Education

Johan Van Niekerk, Rossouw Von Solms

► To cite this version:

Johan Van Niekerk, Rossouw Von Solms. Using Bloom's Taxonomy for Information Security Education. 8th World Conference on Information Security Education (WISE), Jul 2009, Bento Gonçalves, Brazil. pp.280-287, 10.1007/978-3-642-39377-8_33. hal-01463654

HAL Id: hal-01463654

https://inria.hal.science/hal-01463654

Submitted on 9 Feb 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Using Bloom's Taxonomy for Information Security Education

Johan Van Niekerk¹ and Rossouw Von Solms²

Institute for ICT Advancement, Nelson Mandela Metropolitan University
johan.vanniekerk@nmmu.ac.za, rossouw.vonsolms@nmmu.ac.za

**Abstract.** The importance of educating organizational end users about their roles and responsibilities towards information security is widely acknowledged. However, many current user education programs have been created by security professionals who do not necessarily have an educational background. This paper show how the use of learning taxonomies, specifically Bloom's taxonomy, can improve such educational programs. It is the authors belief that proper use of this taxonomy will assist in ensuring the level of education is correct for the intended target audience.

## 1 Introduction

The primary aim of corporate information security education is to ensure that each and every employee is instilled with the requisite **knowledge** and/or skills to perform his or her function in a secure way [1]. Most current information security educational programs are constructed by information security specialists who do not necessarily have a strong educational background. Studies have shown that the vast majority of current awareness approaches lacks theoretical grounding [2, pp. 33-56]. The nature of security educational or awareness issues are often not understood, which could lead to programs and guidelines that are ineffective in practice [3]. This paper shows how the use of Bloom's revised taxonomy [4], as a pedagogical framework, can assist the creators of information security educational programs in defining more pedagogically sound learning objectives for the humans involved in information security processes.

The work in this paper is based on qualitative research methods. This paper should thus be seen as "an inquiry process of understanding based on distinct methodological traditions of inquiry that explore a social or human problem" [5, p. 15]. Since education, as a field of study, is normally seen as a "human science" it was deemed fitting to also "borrow" the research paradigm used in this paper from the humanities. The research presented here does not attempt to define *new* knowledge, but rather to show how an existing taxonomy, Bloom's taxonomy, could be used to improve information security *educational* programs. This paper is an expansion on ideas previously published by the authors in [6]. It is the authors' belief that the use of Bloom's taxonomy could improve the understanding of the pedagogical, or learning, objectives that **should** be considered in any educational program, amongst information security specialists.
The rest of this paper will briefly examine this taxonomy, before discussing its
possible use in information security education.

## 2 Bloom's taxonomy of the cognitive domain

Bloom's taxonomy is possibly one of the best known and most widely used
models of human cognitive processes. Bloom's model was originally developed
in the 1950's and remained in use more or less unchanged until fairly recently
[7, p. 249]. A revised version of the taxonomy was published in 2001 [4]. This
revised taxonomy has become accepted as more appropriate in terms of current
educational thinking [7, pp. 249-260]. Both versions of Bloom's taxonomy consist
of six levels which increases in complexity as the learner moves up through these
levels. Figure 1 shows both versions of this taxonomy.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Blooms Taxonomy, Original and Revised (Adapted from Sousa (2006) pp. 249-250)</figcaption></figure>

There are two main differences between the original and the revised ver-
sions of the taxonomy. Firstly, the revised version uses descriptive verbs for each
level that more accurately describes the intended meaning of each level. Sec-
ondly, the revised version has swapped the last two levels of the original version
around. This was done because recent studies have suggested that generating,
planning, and producing an original "product" demands more complex thinking
than making judgements based on accepted criteria [7, p. 250]. The hierarchy of
complexity in the revised taxonomy is also less rigid than in the original in that
it recognizes that an individual may move among the levels during extended cog-
nitive processes. This paper will focus on the revised version of the taxonomy.
Wherever this paper mentions Bloom's taxonomy, it should be assumed that
the revised version is intended, unless otherwise stated. The following is a brief
explanation of each of the six levels of this revised taxonomy [7, pp. 250-252]:
- Remember: Remember refers to the rote recall and recognition of previously learned facts. This level represents the lowest level of learning in the cognitive domain because there is no presumption that the learner understands what is being recalled.

- Understand: This level describes the ability to "make sense" of the material. In this case the learning goes beyond rote recall. If a learner understands material it becomes available to that learner for future use in problem solving and decision making.

- Apply: The third level builds on the second one by adding the ability to use learned materials in new situations with a minimum of direction. This includes the application of rules, concepts, methods and theories to solve problems within the given domain. This level combines the activation of procedural memory and convergent thinking to correctly select and apply knowledge to a completely new task. Practice is essential in order to achieve this level of learning.

- Analyze: This is the ability to break up complex concepts into simpler components in order to better understand its structure. Analysis skills includes the ability to recognize underlying parts of a complex system and examining the relationships between these parts and the whole. This stage is considered more complex than the third because the learner has to be aware of the thought process in use and must understand both the content and the structure of material.

- Evaluate: Evaluation deals with the ability to judge the value of something based on specified criteria and standards. These criteria and/or standards might be determined by the learner or might be given to the learner. This is a high level of cognition because it requires elements from several other levels to be used in conjunction with conscious judgement based on definite criteria. To attain this level a learner needs to consolidate their thinking and should also be more receptive to alternative points of view.

- Create: This is the highest level in the taxonomy and refers to the ability to put various parts together in order to formulate an idea or plan that is new to the learner. This level stresses creativity and the ability to form new patterns or structures by using divergent thinking processes.

In addition to these levels of the cognitive domain [4] also places major emphasis on the use of the following categorization of the knowledge dimension [4, pp. 45-62]:

- Factual Knowledge - The most basic elements the learner must know in order to be familiar with a discipline. I.e. Terminology or specific details and elements.

- Conceptual Knowledge - The interrelationships among the basic elements of larger structures that enable these elements to function together. I.e. Classification, categories, principles, theories, models, etc.

- Procedural Knowledge - How to do something, methods of inquiry, how to use skills, apply algorithms, techniques and methods. I.e. Subject specific
skills, algorithms, techniques, and methods as well as knowledge of criteria for determining when to use appropriate procedures.

- Meta-Cognitive Knowledge - An awareness and knowledge of one's own cognition. I.e. Strategic knowledge, Self-knowledge, knowledge about cognitive tasks, including contextual and conditional knowledge.

Activities at these six levels of the cognitive domain are usually combined with the one or more of the four types of knowledge in a collection of statements outlining the learning objectives of an educational program. Usually a *learning objective* statement will be used to create a set of *learning activities*. Learning activities are activities which help learners to attain the learning objectives. A Learning activity consist of a *verb* that relates to an activity at one of the levels of the cognitive domain, and a *noun* providing additional insight into the relationship of the specific learning objective to a category of knowledge [4, pp. 93-109]. The use of a taxonomy often assist educators in gaining better understanding of learning objectives, and activities. However, it is not always clear how this increased understanding can help the educators. [4, pp. 6-10] identifies the following four "organizing questions" as the most important areas in which a taxonomy like Bloom's can assist educators:

- The Learning Question: What is the most important for learners to learn in the limited time available

- The Instruction Question: How does one plan and deliver instruction that will result in high levels of learning for large numbers of learners

- The Assessment Question: How does one select or design assessment instruments and procedures to provide accurate information about how well students are learning

- The Alignment Question: How does one ensure that objectives, instruction, and assessment are consistent with each other.

In most cases, the correct usage of a *taxonomy table*, like the one given in Table 2, which combines elements from both the cognitive and knowledge dimensions, will allow educators to answer these question to some extent.

## 3 Bloom's Taxonomy for Information Security Education

Learning taxonomies assist the educationalist to describe and categorize the stages in cognitive, affective and other dimensions, in which an individual operates as part of the learning process. In simpler terms one could say that learning taxonomies help us to "understand about understanding" [8]. It is this level of meta-cognition that is often missing in information security education. According to Siponen awareness and educational campaigns can be broadly described by two categories, namely framework and content [3]. The framework category contains issues that can be approached in a structural and quantitative manner. These issues constitute the more explicit knowledge. The second category, however, includes more tacit knowledge of an interdisciplinary nature. Shortcomings
in this second area usually invalidate awareness frameworks [3]. How to really motivate users to adhere to security guidelines, for example, is an issue that would form part of this content category.

<table><caption>**Table 1.** Abbreviated example of Learning Activities based on Bloom's Taxonomy for Information Security, adapted from Anderson et al., 2001</caption><thead><tr><td>Level</td><td>Verb</td><td>Sample Activities</td></tr></thead><tbody><tr><td>Create</td><td>design</td><td>Write a new policy item to prevent users from putting sensitive information on mobile devices. (A6)</td></tr><tr><td>Evaluate</td><td>critique</td><td>Critique these two passwords and explain why you would recommend one over the other in terms of the security it provides. (A5)</td></tr><tr><td>Analyze</td><td>analyze</td><td>Which of the following security incidents involving stolen passwords are more likely in our company? (A4)</td></tr><tr><td>Apply</td><td>execute</td><td>Use the appropriate application to change your password for the financial sub-system. (A3)</td></tr><tr><td>Understand</td><td>discuss</td><td>Why should non alpha-numeric characters be used in a password? (A2)</td></tr><tr><td>Remember</td><td>define</td><td>What is the definition of access control? (A1)</td></tr></tbody></table>

In order to ensure successful learning amongst all employees, it is extremely important to fully understand the educational needs of individual employees. Managers often attempt to address the security education needs of employees without adequately studying and understanding the underlying factors that contribute to those needs [9, pp. 27-36]. It has been argued before that educational material should ideally be tailored to the learning needs and learning styles of individual learners [10][11, p. 19]. One could also argue that awareness campaigns that have not been tailored to the **specific** needs of an individual, or the needs of a **specific target audience**, will be ineffective. It is in the understanding of these needs, that a learning taxonomy can play an important enabling role.

Information security specialists should use a taxonomy, like Bloom's taxonomy, before compiling the content category of the educational campaign. The use of such a taxonomy could help to understand the learning needs of the target audience better. It could also reduce the tendency to focus only on the framework category of these campaigns. For example, simply teaching an individual what a password is, would lie on the *remember*, and possibly *understand* level(s) of Bloom's taxonomy. However, the necessary information to understand *why* their own passwords is also important and should also be properly constructed and guarded might lie as high as the *evaluate* level of the taxonomy. An information security specialist might think that teaching the users what a password is, is enough, but research have shown that understanding *why* is essential to obtaining buy-in from employees. It is this level of understanding that acts as a motivating factor and thus enables behaviour change [3][10][9, pp. 78-79].
The use of an educational taxonomy in the construction of information security educational programs requires that both the content and the assessment criteria for this program is evaluated against the taxonomy in order to ensure that learning takes place at the correct level of the cognitive domain. The reference point for any educational program should be a set of clearly articulated "performance objectives" that have been developed based on an assessment of the target audience's needs and requirements [9, p. 96]. Correct usage of an educational taxonomy not only helps to articulate such performance objectives but, more importantly, helps the educator to correctly gauge the needs and requirements of the audience.

An example of how Bloom's revised taxonomy could be used in an information security context is supplied in Table 1. This example contains learning activities for a learning objective (LO1) that can be briefly expressed as: "Learners should be able to understand, construct and use passwords in the correct context". This example is not intended to be a definitive work, but rather to serve, with taxonomy table Table 2, towards clarifying the use of Bloom's taxonomy in an information security context.

<table><caption>**Table 2.** Example Taxonomy Table adapted from Anderson et al., 2001</caption><thead><tr><th rowspan="2">The Knowledge Dimension</th><th colspan="6">The Cognitive Process Dimension</th></tr><tr><th>Remember</th><th>Understand</th><th>Apply</th><th>Analyze</th><th>Evaluate</th><th>Create</th></tr></thead><tbody><tr><th>Factual Knowledge</th><td>A1</td><td></td><td></td><td></td><td>A6</td><td></td></tr><tr><th>Conceptual Knowledge</th><td></td><td>Test1A<br>A2</td><td></td><td>Test1B<br>A4</td><td>A6</td><td></td></tr><tr><th>Procedural Knowledge</th><td></td><td></td><td>LO1<br>A3</td><td></td><td>A6</td><td></td></tr><tr><th>Meta-Cognitive Knowledge</th><td></td><td></td><td></td><td></td><td>A5</td><td></td></tr></tbody></table>

It was mentioned earlier that answering the four "organizing questions" is one of the most difficult things for creators of educational matter to do. The following sub-section will briefly explain how the taxonomy table, Table 2 could be used to assist in answering these question for the learning activities, as shown in Table 1.

## 3.1 Answering the four "Organizing Questions"

Each learning activity in Table 1 consist of a *verb* that relates to one of the cognitive domain levels in Bloom's Taxonomy [4, pp 67-68]. Each activity also has a *noun* relating to knowledge that could be categorized as one of the four categories of knowledge. By marking the appropriate spaces in the taxonomy
table for each activity, the educator can derive a lot of useful information about the "coverage" provided by the activities. As an example, the activity marked **A1** Lies at the remember level of the cognitive domain and since it deals with basic subject terminology it deals with the "factual" category of knowledge. This is reflected by its positioning in Table 2. Each of the other activities, **A2** to **A6**, as shown in Table 1 has also been appropriately placed in Table 2. A complete information security educational program will obviously include many more activities, which would result in many more entries in the taxonomy table. Such a table do not always have to deal with an entire program, but could, like the given example, focus on a single learning objective, or even on a few related objectives.

By examining the taxonomy table the educator can easily identify areas of knowledge, or levels of the cognitive domain, that has not been covered by the learning activities. Similarly, areas where multiple activities covers the same levels of cognition and categories of knowledge can be identified. This can assist in answering the so-called "learning question", i.e. "are most important activities receiving the larger share of the available resources?". In order to design activities that will result in maximum learning, thus answering the "learning question", one can look for activities that involves more than just one type of knowledge. For example, in order to create a new policy item (Activity **A6**), the learner will need to know; basic terminology (factual knowledge), how items relate to each other (conceptual knowledge), and which steps to follow to create a policy (procedural knowledge). To answer the "assessment question" the educator could choose to focus on the learning objective itself, and thus, in the example given, only use assessment methods that require the learner to apply procedural knowledge. Or the assessor might decide to focus on one or more learning activities and thus have a wider range of assessment coverage. By noting assessment activities on the same taxonomy table, the educator can ensure that the chosen assessments correspond directly to what he/she intends to assess. For example, that learners must *understand* the concept of a password (*Test1A*) and must be able to *analyze* the relative strength of a given password (*Test1B*). The table will also, at a glance, show which areas are not being assessed. Finally, given a complete taxonomy table, the "alignment question" should be relatively easy to answer. In the given example, a clear "disconnect" between the assessment and the learning objective itself exist. Instead of focusing on the **application**, or **use**, of passwords the assessments focus on the concept of what a password is, and how to determine its relative strength. Similarly, other "miss-alignments" can be identified with the help of this taxonomy table.

# 4 Conclusion

This paper suggested that information security educational programs would be more effective if they adhered to pedagogical principles. It was specifically suggested that an educational taxonomy, like Bloom's taxonomy should be used to accurately define the security education needs of organizational users. Through
the use of such a taxonomy certain common weaknesses in current security awareness and educational programs might be addressed.

An example of how Bloom's taxonomy might be applied to a learning objective in an information security educational program was provided. The paper used this brief example, to show how a taxonomy table based on this example, could assist educators in addressing the four "organizing questions" faced by educators. The primary weakness of this paper is the lack of empirical evidence to support the suggested use of Bloom's taxonomy. Due to space limitations, the examples are also by necessity, very brief. Future research in this regard should focus on addressing the lack of empirical evidence, and on expanding the examples to be more comprehensive. It has been argued before that security practitioners who engage in research or activities that relate to the human sciences should not re-invent the wheel, but should rather "borrow" from the humanities when appropriate. This paper is one such an attempt, to "borrow" from the humanities.

## References

[1] Van Niekerk, J., Von Solms, R.: An holistic framework for the fostering of an information security sub-culture in organizations. Information Security South Africa (ISSA), Johannesburg, South Africa (2005)

[2] Puhakainen, P.: A design theory for information security awareness. PhD thesis, Acta Universitatis Ouluensis A 463, The University of Oulu (2006)

[3] Siponen, M.: A conceptual foundation for organizational information security awareness. Information Management & Computer Security 8(1) (2000) 31–41

[4] Anderson, L., Krathwohl, D., Airasian, P., Cruikshank, K., Mayer, R., Pintrich, P., Raths, J., Wittrock, M.: A Taxonomy for Learning, Teaching, and Assessing: A Revision of Bloom's Taxonomy of Educational Objectives, Complete Edition. Longman (2001)

[5] Creswell, J.W.: Qualitative Inquiry and Research Design: Choosing among Five Traditions. Thousand Oaks, CA: Sage, 1998. Thousand Oaks, CA: Sage (1998)

[6] Van Niekerk, J., Von Solms, R.: Bloom's taxonomy for information security education. Information Security South Africa (ISSA), Johannesburg, South Africa (2008)

[7] Sousa, D.A.: How the brain learns. 3rd edn. Corwin Press (2006)

[8] Fuller, U., Johnson, C.G., Ahoniemi, T., Cukierman, D., Hernán-Losada, I., Jackova, J., Lahtinen, E., Lewis, T.L., Thompson, D.M., Riedesel, C., Thompson, E.: Developing a computer science-specific learning taxonomy. SIGCSE Bull. 39(4) (2007) 152–170

[9] Roper, C., Grau, J., Fischer, L.: Security Education, Awareness and Training: From Theory to Practice. Elsevier Butterworth Heinemann (2005)

[10] Van Niekerk, J., Von Solms, R.: Corporate information security education: Is outcome based education the solution? 10th IFIP WG11.1 Annual Working Conference on Information Security Management, World Computer Congress (WCC), Toulouse, France (2004)

[11] National Institute of Standards and Technology: NIST 800-16: Information Technology Security Training Requirements: A Role- and Performance-Based Model. NIST Special Publication 800-16, National Institute of Standards and Technology. (1998)