# Information Security Education. Education in Proactive Information Security

Lynette Drevin, Marianthi Theocharidou

► To cite this version:

Lynette Drevin, Marianthi Theocharidou. Information Security Education. Education in Proactive Information Security: 12th IFIP WG 11.8 World Conference, WISE 12, Lisbon, Portugal, June 25–27, 2019, Proceedings. Springer International Publishing, AICT-557, 2019, IFIP Advances in Information and Communication Technology, 978-3-030-23450-8. 10.1007/978-3-030-23451-5 . hal-02365723

HAL Id: hal-02365723

https://inria.hal.science/hal-02365723

Submitted on 15 Nov 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Editor-in-Chief

Kai Rannenberg, Goethe University Frankfurt, Germany

Editorial Board Members

TC 1 – Foundations of Computer Science

Jacques Sakarovitch, Télécom ParisTech, France

TC 2 – Software: Theory and Practice

Michael Goedicke, University of Duisburg-Essen, Germany

TC 3 – Education

Arthur Tatnall, Victoria University, Melbourne, Australia

TC 5 – Information Technology Applications

Erich J. Neuhold, University of Vienna, Austria

TC 6 – Communication Systems

Aiko Pras, University of Twente, Enschede, The Netherlands

TC 7 – System Modeling and Optimization

Fredi Tröltzsch, TU Berlin, Germany

TC 8 – Information Systems

Jan Pries-Heje, Roskilde University, Denmark

TC 9 – ICT and Society

David Kreps, University of Salford, Greater Manchester, UK

TC 10 – Computer Systems Technology

Ricardo Reis, Federal University of Rio Grande do Sul, Porto Alegre, Brazil

TC 11 – Security and Privacy Protection in Information Processing Systems

Steven Furnell, Plymouth University, UK

TC 12 – Artificial Intelligence

Ulrich Furbach, University of Koblenz-Landau, Germany

TC 13 – Human-Computer Interaction

Marco Winckler, University of Nice Sophia Antipolis, France

TC 14 – Entertainment Computing

Rainer Malaka, University of Bremen, Germany
IFIP – The International Federation for Information Processing

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

> IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers.

IFIP distinguishes three types of institutional membership: Country Representative Members, Members at Large, and Associate Members. The type of organization that can apply for membership is a wide variety and includes national or international societies of individual computer scientists/ICT professionals, associations or federations of such societies, government institutions/government related organizations, national or international research institutes or consortia, universities, academies of sciences, companies, national or international associations or federations of companies.

More information about this series at http://www.springer.com/series/6102
Information Security
Education

Education in Proactive Information Security

12th IFIP WG 11.8 World Conference, WISE 12
Lisbon, Portugal, June 25–27, 2019
Proceedings

<figure><img src="image_2.png" /></figure>
Editors

Lynette Drevin

North-West University

Potchefstroom, South Africa

Marianthi Theocharidou

European Commission

Joint Research Center

Ispra, Italy

ISSN 1868-4238

ISSN 1868-422X (electronic)

IFIP Advances in Information and Communication Technology

ISBN 978-3-030-23450-8

ISBN 978-3-030-23451-5 (eBook)

https://doi.org/10.1007/978-3-030-23451-5

© IFIP International Federation for Information Processing 2019

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG

The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

This volume contains the papers presented at the 12th World Conference on Infor-
mation Security Education (WISE 12) held during June 25–27, 2019, in Lisbon. It was
held in conjunction with the 34th IFIP International Conference on Information
Security and Privacy Protection (IFIP SEC 2019). WISE 12 was organized by the IFIP
Working Group 11.8, which is an international group of people from academia, gov-
ernment, and private organizations who volunteer their time and effort to increase
knowledge in the very broad field of information security through education. WG 11.8
has worked to increase information security education and awareness for almost two
decades. This year, WG11.8 organized the 12th conference of a successful series under
the theme “Education in Proactive Information Security.” We received 26 submissions
from around the world. Each submission was blind reviewed by at least three inter-
national Program Committee members. The committee decided to accept 12 full
papers, and thus the acceptance rate for the papers is 46%.

During the conference, a working group discussion addressed the “Graduate Student Pipeline Problem in Cybersecurity.” It was chaired by Susanne Wetzel of Stevens Institute of Technology (USA). The topic is driven by surveys and observations in the USA, which indicate a mismatch between open faculty positions in cybersecurity and the number of accepted academic positions from the newly awarded PhDs in cybersecurity. In fact, the majority of them joined industry. The workgroup discussed the effect on education of the next generation of students in cybersecurity and explored options to address the problem. With high-paying jobs in industry that are already available to graduates from bachelor or master programs, what is the incentive for someone to pursue a PhD? What can and needs to be done in order to attract graduates to academic instead of industry jobs?

This conference took place thanks to the support and commitment of many indi-
viduals. First, we would like to thank all TC-11 members for continually giving us the
opportunity to serve the working group and organize the WISE conferences. Our
sincere appreciation also goes to the members of the Program Committee, to the
external reviewers, and to the authors who trusted us with their intellectual work. We
are grateful for the support of WISE11.8 Officers Lynn Futcher, Matt Bishop, Natalia
Miloslavskaya, and Erik Moore. Finally, we would like to thank the local organizers for
the support. As for the preparation of this volume, we sincerely thank Erika
Siebert-Cole and our publisher Springer for their assistance.

June 2019

Lynette Drevin
Marianthi Theocharidou
## Organization

### Wise12 Conference Chair

Lynn Futcher Nelson Mandela University, South Africa

### WISE12 Program Chair

Lynette Drevin North-West University, South Africa

### WISE12 Conference Secretariat

Matt Bishop University of California, Davis, USA

### WISE12 Publications Chair

Marianthi Theocharidou European Commission, Joint Research Centre, Italy

### WISE12 Local and Logistics Chair

Natalia Miloslavskaya National Research Nuclear University MEPhI, Russia

### WISE12 Web Chair

Erik Moore Regis University, Colorado, USA

### Program Committee

<table><tr><td>Maria Bada</td><td>University of Cambridge, UK</td></tr><tr><td>Matt Bishop</td><td>University of California, Davis, USA</td></tr><tr><td>Jun Dai</td><td>California State University, Sacramento, USA</td></tr><tr><td>Melissa Dark</td><td>Purdue University, USA</td></tr><tr><td>Lynette Drevin</td><td>North-West University, South Africa</td></tr><tr><td>Steven Furnell</td><td>Plymouth University, UK</td></tr><tr><td>Lynn Futcher</td><td>Nelson Mandela Metropolitan University, South Africa</td></tr><tr><td>Ram Herkanaidu</td><td>Plymouth University, UK</td></tr><tr><td>Lech Janczewski</td><td>The University of Auckland, New Zealand</td></tr><tr><td>Audun Josang</td><td>University of Oslo, Norway</td></tr><tr><td>Christos Kalloniatis</td><td>University of the Aegean, Greece</td></tr><tr><td>Sokratis Katsikas</td><td>Center for Cyber and Information Security, NTNU, Norway</td></tr><tr><td>Basel Katt</td><td>Norwegian University of Science and Technology, NTNU, Norway</td></tr></table>
<table><tr><td>Siddharth Kaza</td><td>Towson University, USA</td></tr><tr><td>Andrea Kolberger</td><td>University of Applied Sciences, Upper Austria</td></tr><tr><td>Elmarie Kritzinger</td><td>UNISA, South Africa</td></tr><tr><td>Hennie Kruger</td><td>North-West University, South Africa</td></tr><tr><td>Wai Sze Leung</td><td>University of Johannesburg, South Africa</td></tr><tr><td>Dan Likarish</td><td>Regis University, Colorado, USA</td></tr><tr><td>Javier Lopez</td><td>University of Malaga, Spain</td></tr><tr><td>Edgar Alonso Lopez-Rojas</td><td>Norwegian University of Science and Technology, NTNU, Norway</td></tr><tr><td>Annlize Marnewick</td><td>University of Johannesburg, South Africa</td></tr><tr><td>Natalia Miloslavskaya</td><td>National Research Nuclear University MEPhI, Russia</td></tr><tr><td>Stig Mjolsnes</td><td>Norwegian University of Science and Technology, Norway</td></tr><tr><td>Erik Moore</td><td>Regis University, Colorado, USA</td></tr><tr><td>Ida Ngambeki</td><td>Purdue University, USA</td></tr><tr><td>Jason Nurse</td><td>University of Kent, UK</td></tr><tr><td>Ruxandra F. Olimid</td><td>Norwegian University of Science, Norway and Technology and University of Bucharest, Romania</td></tr><tr><td>Jacques Ophoff</td><td>University of Cape Town, South Africa</td></tr><tr><td>Günther Pernul</td><td>Universität Regensburg, Germany</td></tr><tr><td>Carlos Rieder</td><td>isec ag, Switzerland</td></tr><tr><td>Rudi Serfontein</td><td>North-West University, South Africa</td></tr><tr><td>Chien-Chung Shen</td><td>University of Delaware, USA</td></tr><tr><td>Marianthi Theocharidou</td><td>European Commission, Joint Research Centre, Italy</td></tr><tr><td>Alexander Tolstoy</td><td>National Research Nuclear University MEPhI, Russia</td></tr><tr><td>Ismini Vasileiou</td><td>Plymouth University, UK</td></tr><tr><td>Sune von Solms</td><td>University of Johannesburg, South Africa</td></tr><tr><td>Susanne Wetzel</td><td>Stevens Institute of Technology, USA</td></tr><tr><td>Louise Yngstrom</td><td>Stockholm University, Sweden</td></tr><tr><td>Sergey Zapechnikov</td><td>National Research Nuclear University MEPhI, Russia</td></tr></table>

Additional Reviewer

Ludwig Englbrecht
# Contents

## Innovation in Curricula

An Educational Intervention for Teaching Secure Coding Practices
Vuyolwethu Mdunyelwa, Lynn Futcher, and Johan van Niekerk
3

Learning Principles and the Secure Programming Clinic.
Matt Bishop, Melissa Dark, Lynn Futcher, Johan Van Niekerk,
Ida Ngambeki, Somdutta Bose, and Minghua Zhu
16

Introducing Research into the Undergraduate Curriculum in Cybersecurity
Dimitrios Damopoulos and Susanne Wetzel
30

## Training

A Short-Cycle Framework Approach to Integrating Psychometric
Feedback and Data Analytics to Rapid Cyber Defense.
Erik L. Moore, Steven P. Fulton, Roberta A. Mancuso,
Tristen K. Amador, and Daniel M. Likarish
45

Identifying Security Requirements Body of Knowledge for the Security
Systems Engineer
Suné von Solms and Annlizé Marnewick
59

Andragogy as a Scientific Basis for Training Professionals
in Information Security
Alexander Tolstoy and Natalia Miloslavskaya
72

## Applications and Cryptography

Light Cryptography.
Pascal Lafourcade, Takaaki Mizuki, Atsuki Nagao,
and Kazumasa Shinagawa
89

Blockchain and Its Security: Ignore or Insert into Academic Training?.
Natalia Miloslavskaya and Alexander Tolstoy
102

Identifying Information Security Risks in a Social Network Using
Self-organising Maps.
Rudi Serfontein, Hennie Kruger, and Lynette Drevin
114
Organisational Aspects

<table><tbody><tr><td>Lessons Learned from an Organizational Information Security Awareness Campaign<br><i>Juan-Marc Scrimgeour and Jacques Ophoff</i></td><td>129</td></tr><tr><td>A Comprehensive Framework for Understanding Security Culture in Organizations<br><i>Alaa Tolah, Steven M. Furnell, and Maria Papadaki</i></td><td>143</td></tr><tr><td>Using Gamification to Improve Information Security Behavior: A Password Strength Experiment<br><i>Jacques Ophoff and Frauke Dietz</i></td><td>157</td></tr><tr><td><b>Author Index</b></td><td>171</td></tr></tbody></table>