# Use Case Based Blended Teaching of IIoT Cybersecurity in the Industry 4.0 Era
## 2 State of the Art  
### IIoT and Industry 4.0 Cybersecurity Teaching  
Although industry has been increasingly targeted by cybersecurity attacks, its security is not widely studied in IT university programs. In fact, few university programs have incorporated explicitly cybersecurity topics [27], despite considering such a field as a core competency of future IT engineers [28] and recognizing the existence of an increasing gap in qualified cybersecurity professionals [29]. Moreover, in the first semester of 2020 the COVID-19 pandemic caused a massive impact in the higher education system, forcing institutions to put in practice emergency online and blended models, and to implement measures to reinforce and guarantee social distancing (e.g., strategies to compensate for limited classroom space). Unfortunately, as of writing, the vast majority of cybersecurity courses follow the traditional lecture-and-lab structure, but some educators have proposed to make use of the latest technologies to ease remote learning and provide more realistic experiences. Thus, several authors described cloud-based systems that allow for implementing online cybersecurity courses. For example, [PERSON] et al. [30] propose the use of a virtual classroom system based on Amazon Web Services for teaching cybersecurity, while other authors propose the use of an off-campus network laboratory with low-cost platforms as lightweight honeypots [31]. Similarly, [PERSON] et al. [32] suggest easing cybersecurity experiments by providing online tools through a concept that the authors call Cybersecurity Lab as a Service (CLaaS). In the specific case of IIoT cybersecurity teaching, just a few works can be found in the literature. One of them is proposed by [PERSON] et al. [33], who present a framework for creating a virtual cybersecuritylab able to incorporate IIoT and embedded systems. Another interesting work was carried out by [PERSON] et al. [34], who focused on describing a course on hardware reverse engineering that analyzes the practical security of devices like Field-Programmable Gate Arrays (FPGAs), which have been used by Industrial Control Systems (ICSs). In the case of [PERSON] et al. [35], they described a program of a course on cybersecurity oriented towards cyber-physical systems. To engage students on industrial cybersecurity, some researchers proposed to gamify learning through case-based approaches [36], which can be performed together with penetration testing competitions [37], capture-the-flag games [38; 39], challenge-based platforms [40], defenders versus attackers competitions [41] or secure development contests [42]. For example, in [43] the authors added an educational game to teach students ICS cybersecurity to their flipped learning methodology [44]. Another good example is detailed in [45], where gamification is analyzed when teaching industrial cybersecurity through Kaspersky Industrial Protection Simulation (KIPS) [46]. In addition to the courses described in recent academic literature, there is hands-on professional training provided by private education organizations that offer different certifications [47]. For example, SANS offers a specialized course on ICS active defense and incident response that leverages tools like Shodan [48]. Online courses (e.g., Massive Open Online Courses (MOOCs)) like the Master Certificate In Cyber Security [49] and novel digital tools are also easily accessible and scalable teaching approaches. Such courses and tools provide a fast and cost-efficient way to deliver location-independent content and even to replace on-site lectures of instructors [29]. However, they do not adjust adequately to the learning capabilities or disciplines of the students (e.g., IT, criminology, legal studies), they do not support team building, communication and interpersonal skills, and they do not reinforce the value of tutoring.