Collaborative Research: SaTC: EDU: Dual-track Role-based Learning for Cybersecurity Analysts and Engineers for Effective Defense Operation with Data Analytics

Cybersecurity defense operations (cyber-ops) are in dire need of effective and expedited learning programs for practicing professionals to infuse data analytics (i.e., data science, artificial intelligence, and machine learning) into their day-to-day tasks. To combat the evolving threat landscape, effective cyber-ops often involve a team of cybersecurity analysts and engineers with complementary expertise.

The analysts need effective, usable, and potentially customized data analytics, which are developed by or in collaboration with the engineers. Currently, in-service training for cybersecurity analysts and engineers who need to use data analytics for cyber-ops are limited. No existing program addresses the need to develop the collaborative mindsets and practices that are necessary to work effectively together.

This project aims to develop an innovative dual-track learning program for working cybersecurity analysts and engineers that leverages role-playing within a simulated organization and involves tasks that are specific to each group as well as tasks where they need to work together as a team. This innovative design will help promote collaboration while also enhancing learning of specific data analytic knowledge and skills needed by each type of professional in a realistic work environment.

The program features a combination of remote learning modules and tasks, team coach sessions, and team-based incident response exercises. Progressively deeper learning about data analytics will occur as the scale and complexity of the cyber-op tasks assigned to the participants, as members of a simulated organization, are gradually increased. The program was designed in collaboration with education researchers.

The design is informed by education theories and principles, including Identity Theory, Project-based Design, Understanding by Design, and Universal Design for Learning. The program’s design will also build on prior successful experiences with entry-level cybersecurity bootcamps employing simulations, cybersecurity competitions, and teaching and deployment of research advances for cyber-ops.

The program will be refined through three iterations following a Design-based Research approach, and its effects evaluated by an external evaluation team.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.