Active Learning and Cybersecurity Training: Best practices and recommendations on using Cyber Ranges
Rasmi Vlad Mahmoud, Μάριος Αναγνωστόπουλος, Jens Myrup Pedersen · VBN Forskningsportal (Aalborg Universitet) · 2024
Cybersecurity education commences at the high school level through gamified formats, seminars, or practical exercises. This educational trajectory extends to universities and corporate settings where the motivation varies. Cybersecurity training is facilitated by active learning and its dynamic approach which immerses learners in practical experiences, fostering adaptability in a rapidly evolving field. Suitable technologies for such approach are cyber ranges, these virtual environments mimic real-world IT infrastructure, providing a dynamic arena to face realistic cybersecurity scenarios, being defensive, offensive, or in tandem, within a secure environment. However, despite the evolution of the cyber range technologies in terms of technological and learning capabilities, there remain room for enhancing their integration into classroom activities. Our research endeavours to explore the integration of cyber ranges into pedagogical approaches by exploring existing literature and building upon Kolb's experiential learning framework. Specifically, emphasising the iterative nature of learning, this study situates the process within the realms of preparation, execution, and reflection on a cyber range. Lastly, it maps the learning outcomes with the ENISA’s European Cybersecurity Skills Framework (ECSF) to facilitate the linkage between cybersecurity training and market’s requirements. Our aim is to provide educators with a thought process to make informed decisions regarding the integration of a cyber range into their educational curricula. This entails reflecting on the diverse needs of target audiences, considering prior knowledge, and aligning instructional goals with desired outcomes.