Métodos y efectos de la educación en ciberseguridad: una revisión sistemática

• Alberto Beltrán ^[1] ; Manuel G. Jiménez-Torres ^[1] ; Sara Sampayo ^[2]
  1. [1] Universidad de Granada

     Universidad de Granada

     Granada, España

     
  2. [2] Universidad Miguel Hernández de Elche

     Universidad Miguel Hernández de Elche

     Elche, España

     
• Localización: REC: Revista Electrónica de Criminología, ISSN-e 2695-2882, Vol. 7, 2023
• Idioma: español
• Títulos paralelos:
  • Methods and effects of cybersecurity education: a systematic review
• Enlaces
  • Texto completo
• Resumen
  • español

    Este estudio tiene como objetivo analizar las técnicas educativas en el área de ciberseguridad y ciberdelincuencia, concretamente, las dirigidas a población no-técnica. Se llevó a cabo una revisión sistemática de la literatura científica empleando las bases de datos Scopus, Web of Science y Proquest. Tras analizar 79 artículos, se encontró que la gamificación, el entrenamiento, la simulación, el multimétodo y los medios audiovisuales son las técnicas más habituales y con mejores resultados de efectividad. También se encontró que los estudios se centran más en la ciberseguridad y las herramientas de protección que en educar en las ciberamenazas y concienciar. Por otra parte, se halló un reparto equitativo de los estudios siguiendo el criterio edad, con la excepción de la educación dirigida a la tercera edad, que resultó ser escasa. Finalmente, se encontró que existe fuerte predominancia de las ciencias STEAM, como ciencias computacionales e informática, frente a las ciencias sociales (psicología, criminología o ciencias de la educación), existiendo una grave falta de interdisciplinariedad en el área de estudio.

  • English

    The aim of this study was to analyze educational techniques in the area of cybersecurity and cybercrime, specifically those aimed at non-technical population. A systematic review of the scientific literature was carried out using the Scopus, Web of Science and Proquest databases. After analyzing 79 articles, it was found that gamification, training, simulation, multimethod and audiovisual media are the most common techniques with the best results in terms of effectiveness. It was also found that studies focus more on cybersecurity and protection tools than on educating on cyber threats and awareness. On the other hand, we found an even distribution of studies according to the age criterion, with the exception of education aimed at the elderly, which was found to be scarce. Finally, it was found that there is a strong predominance of STEAM sciences, such as computer science and informatics, as opposed to social sciences (psychology, criminology or educational sciences), with a serious lack of interdisciplinarity in the area of study.

• Referencias bibliográficas
  • Al-Daeef, M.M., Basir, N., & Saudi, M.M. (2017). Security awareness training: A review. Lecture Notes in Engineering and Computer Science,...
  • Al-Hamar, Y., & Kolivand, H. (2020). A New Email Phishing Training Website. Proceedings - International Conference on Developments in...
  • Aldawood, H., & Skinner, G. (2018). Educating and Raising Awareness on Cyber Security Social Engineering: A Literature Review. In Lee,...
  • Alencar, G. D., de Lima, M. F., & Firmo, A. C. A. (2013). Behavioral analysis as a means to prevent social engineering and phishing. RESI...
  • Alqahtani, H., & Kavakli-Thorne, M. (2020). Design and evaluation of an augmented reality game for cybersecurity awareness (CybAR). Information...
  • Althobaiti, K., Vaniea, K., & Zheng, S. (2018). Faheem: Explaining URLs to people using a Slack bot. Proceedings of AISB Annual Convention...
  • Alwanain, M., I. (2020). Phishing Awareness and Elderly Users in Social Media. International Journal of Computer Science and Network Security,...
  • Alwanain, M., I. (2021). How Do Children Interact with Phishing Attacks? International Journal of Computer Science and Network Security, 21(3),...
  • Amo, L. C., Liao, R., Frank, E., Rao, H. R., & Upadhyaya, S. (2019). Cybersecurity Interventions for Teens: Two Time-Based Approaches....
  • Baillon, A., de Bruin, J., Emirmahmutoglu, A., van de Veer, E., & van Dijk, B. (2019). Informing, simulating experience, or both: A field...
  • Baslyman, M., & Chiasson, S. (2016). «smells Phishy?»: An educational game about online phishing scams. eCrime Researchers Summit, eCrime,...
  • Beckers, K., Pape, S., & Fries, V. (2016). HATCH: Hack and trick capricious humans – A serious game on social engineering. Proceedings...
  • Bosch-Capblanch X., Lavis, J.N., Lewin, S., Atun, R., Røttingen, J.A., Dröschel D., Beck, L., Abalos, E., El-Jardali, F., Gilson, L., Oliver,...
  • Burris, J., Deneke, W., & Maulding, B. (2018). Activity simulation for experiential learning in cybersecurity workforce development. Lecture...
  • Chadee, D., & Ng Ying, N.K. (2013). Predictors of fear of crime: general fear verses perceived risk. Journal of Applied Psychology, 43(1),...
  • Chattopadhyay, A., Christian, D., Oeder, A., & Budul, I. (2019). A Novel Visual-Privacy Themed Experiential- Learning Tool for Human-Privacy...
  • Chen, T., Stewart, M., Bai, Z., Chen, E., Dabbish, L., & Hammer, J. (2020). Hacked time: Design and evaluation of a selfefficacy based...
  • Choi, K. (2008). Computer Crime Victimization and Integrated Theory: An Empirical Assessment. International Journal of Cyber Criminology 2...
  • Coenraad, M., Pellicone, A., Ketelhut, D. J., Cukier, M., Plane, J., & Weintrop, D. (2020). Experiencing Cybersecurity One Game at a Time:...
  • Cornel, C., Cornel, C. M., Rowe, D. C., & Moses, S. (2016). A cybersecurity camp for girls. ASEE Annual Conference and Exposition, Conference...
  • Cuchta, T., Blackwood, B., Devine, T. R., Niichel, R. J., Daniels, K. M., Lutjens, C. H., Maibach, S., & Stephenson, R. J. (2019). Human...
  • Davinson, N., & Sillence, E. (2010). It won’t happen to me: Promoting secure behaviour among internet users. Computers in Human Behavior,...
  • De Bona, M., & Paci, F. (2020). A real world study on employees’ susceptibility to phishing attacks. ACM International Conference Proceeding...
  • Deterding, S., Dixon, D., Khaled, R., & Nacke, L. (2011). From game design elements to gamefulness: defining gamification. 15th international...
  • Decusatis, C., Gormanly, B., Alvarico, E., Dirahoui, O., McDonough, J., Sprague, B., Maloney, M., Avitable, D., & Mah, B. (2022). A Cybersecurity...
  • Dodge, R., Coronges, K., & Rovira, E. (2012). Empirical benefits of training to phishing susceptibility. IFIP Advances in Information...
  • Ganesh, A., Ndulue, C., & Orji, R. (2022). Smartphone Security and Privacy – A Gamified Persuasive Approach with Protection Motivation...
  • Ghernaouti-Helie, S. (2009). An Inclusive Information Society Needs a Global Approach of Information Security. 2009 International Conference...
  • Giannakas, F., Kambourakis, G., & Gritzalis, S. (2015). CyberAware: A mobile game-based app for cybersecurity education and awareness....
  • Giannakas, F., Kambourakis, G., Papasalouros, A., & Gritzalis, S. (2016). Security education and awareness for K-6 going mobile. International...
  • Giannakas, F., Papasalouros, A., Kambourakis, G., & Gritzalis, S. (2019). A comprehensive cybersecurity learning platform for elementary...
  • Gokul, C. J., Pandit, S., Vaddepalli, S., Tupsamudre, H., Banahatti, V., & Lodha, S. (2018). Phishy—A serious game to train enterprise...
  • González, J., Buñuel, J.C., & González, P. (2012). Listas guía de comprobación de estudios observacionales: declaración STROBE. Evid Pediatr....
  • Grant, M.J., & Booth, A. (2009). A typology of reviews: an analysis of 14 review types and associated methodologies. Health Information...
  • Hadlington, L., & Chivers, S. (2018). Segmentation analysis of susceptibility to cybercrime: Exploring individual differences in information...
  • Herzberg, A., & Margulies, R. (2011). Forcing Johnny to login safely: Long-term user study of forcing and training login mechanisms. Lecture...
  • Hutton, B., Catalá-López, F., & Moher, D. (2016). La extensión de la declaración PRISMA para revisiones sistemáticas que incorporan metaanálisis...
  • Huynh, D., Luong, P., Iida, H., & Beuran, R. (2017). Design and evaluation of a cybersecurity awareness training game. Lecture Notes in...
  • Jampen, D., Gür, G., Sutter, T., & Tellenbach, B. (2020). Don’t click: towards an effective anti-phishing training. A comparative literature...
  • Jin, G., Tu, M., Kim, T.-H., Heffron, J., & White, J. (2018). Game based cybersecurity training for High School Students. SIGCSE 2018...
  • Kaabi, L. A., Ketbi, W. A., Khoori, A. A., Shamsi, M. A., & Alrabaee, S. (2022). Safe: Cryptographic Algorithms and Security Principles...
  • Kolb, C., Strouse, J., Palmer, J., Ford, V., & Turygina, V. (2022). Cyber Securing the Future. AIP Conference Proceedings, 2425. https://doi.org/10.1063/5.0081419
  • Kovačević, A., & Radenković, S. D. (2020). SAWIT—Security Awareness Improvement Tool in the Workplace. Applied Sciences, 10(9), 3065....
  • Kunz, A., Volkamer, M., Stockhardt, S., Palberg, S., Lottermann, T., & Piegert, E. (2016). NoPhish: Evaluation of a web application that...
  • Kumaraguru, P., Rhee, Y., Acquisti, A., Cranor, L. F., Hong, J., & Nunge, E. (2007). Protecting people from phishing: The design and evaluation...
  • Kumaraguru, P., Rhee, Y., Sheng, S., Hasan, S., Acquisti, A., Cranor, L. F., & Hong, J. (2007). Getting users to pay attention to anti-phishing...
  • Kumaraguru, P., Sheng, S., Acquisti, A., Cranor, L. F., & Hong, J. (2008). Lessons from a real world evaluation of antiphishing training....
  • Kumaraguru, P., Cranshaw, J., Acquisti, A., Cranor, L., Hong, J., Blair, M. A., & Pham, T. (2009). School of phish: A real-world evaluation...
  • Lastdrager, E., Gallardo, I. C., Hartel, P., & Junger, M. (2019). How effective is anti-phishing training for children? Proceedings of...
  • Liberati, A., Altman, D. G., Tetzlaff, J., Mulrow, C., Gotzsche, P. C., Ioannidis, J. P. A., & Moher, D. (2009). The PRISMA statement...
  • Lim, I., Park, Y.-G., & Lee, J.-K. (2016). Design of Security Training System for Individual Users. Wireless Personal Communications,...
  • López, J., Sánchez, F., Herrera, D., Martínez, F., Rubio, M., Gil, V., Santiago, A.M., & Gómez, M.A . (2021). Informe sobre la Cibercriminalidad...
  • Maqsood, S., & Chiasson, S. (2021). Design, Development, and Evaluation of a Cybersecurity, Privacy, and Digital Literacy Game for Tweens....
  • Mikka-Muntuumo, J., & Peters, A. N. (2021). Designing an Interactive Game for Preventing Online Abuse in Namibia. 2021 3rd International...
  • Moreno-Fernández, M. M., Blanco, F., Garaizar, P., & Matute, H. (2017). Fishing for phishers. Improving Internet users’ sensitivity to...
  • Mugayitoglu, B., Borowczak, M., Burrows, A., Carson, A., Person, C., Finch, A., & Kennedy, C. (2021). A university’s developmental framework:...
  • Neo, H.F., Teo, C.C., & Peng, C. L. (2021). Safe Internet: An Edutainment Tool for Teenagers. Lecture Notes in Electrical Engineering,...
  • Newbould, M., & Furnell, S. (2009). Playing safe: A prototype game for raising awareness of social engineering. Proceedings of the 7th...
  • Olano, M., Sherman, A., Oliva, L., Cox, R., Firestone, D., Kubik, O., Patil, M., Seymour, J., Sohn, I., & Thomas, D. (2014). SecurityEmpire:...
  • ONTSI (Observatorio Nacional de Tecnología y Sociedad). (2022). Cómo se protege a la ciudadanía ante los ciberriesgos. Estudio sobre percepción...
  • Peker, Y. K., Ray, L., da Silva, S., & IEEE. (2018). Online Cybersecurity Awareness Modules for College and High School Students (WOS:000463185700004)....
  • Perestelo-Pérez, L. (2013). Standards on how to develop and report systematic reviews in Psychology and Health. International Journal of Clinical...
  • Pittman, J. M., & Pike, R. E. (2016). An Observational Study of Peer Learning for High School Students at a Cybersecurity Camp. Information...
  • Plachkinova, M., & Menard, P. (2019). An Examination of Gain- and Loss-Framed Messaging on Smart Home Security Training Programs. Information...
  • Quinkert, F., Degeling, M., & Holz, T. (2021). Spotlight on Phishing: A Longitudinal Study on Phishing Awareness Trainings. Lecture Notes...
  • Qusa, H., & Tarazi, J. (2021). Cyber-Hero: A Gamification framework for Cyber Security Awareness for High Schools Students. 2021 IEEE...
  • Rastenis, J., Ramanauskaitė, S., Janulevičius, J., & Čenys, A. (2020). Impact of information security training on recognition of phishing...
  • Reid, R., & Van Niekerk, J. (2014). Snakes and ladders for digital natives: Information security education for the youth. Information...
  • Reid, R., & Van Niekerk, J. (2015). A cyber security culture fostering campaign through the lens of active audience theory. Proceedings...
  • Reinheimer, B., Aldag, L., Mayer, P., Mossano, M., Duezguen, R., Lofthouse, B., von Landesberger, T., & Volkamer, M. (2020). An investigation...
  • Saito, T., Yashiro, S., Tanabe, K., & Saito, Y. (2019). A Proposal and the Evaluation of a Hands-On Training System for Cyber Security....
  • Salazar, M., Gaviria, J., Laorden, C., & Bringas, P. G. (2013). Enhancing cybersecurity learning through an augmented reality-based serious...
  • Schoebel, S., Roepke, R., & Schroeder, U. (2021). Phishing Academy: Evaluation of a Digital Educational Game on URLs and Phishing. Lecture...
  • Scholefield, S., & Shepherd, L. A. (2019). Gamification Techniques for Raising Cyber Security Awareness. Lecture Notes in Computer Science...
  • Sercombe, A. A., & Papadaki, M. (2012). Education in the «virtual» community: Can beating Malware Man teach users about social networking...
  • Septiana, R., & Julian, R. K. (2020). Design of Phishing Simulation Dashboard Using Analytic Data Concepts. Journal of Physics: Conference...
  • Shen, L. W., Mammi, H. K., & Din, M. M. (2021). Cyber Security Awareness Game (CSAG) for Secondary School Students. 2021 International...
  • Sheng, S., Magnien, B., Kumaraguru, P., Acquisti, A., Cranor, L. F., Hong, J., & Nunge, E. (2007). Anti-Phishing Phil: The design and...
  • Silic, M., & Lowry, P. B. (2020). Using Design-Science Based Gamification to Improve Organizational Security Training and Compliance:...
  • Sookhanaphibarn, K., & Choensawat, W. (2020). Educational games for cybersecurity awareness. 2020 IEEE 9th Global Conference on Consumer...
  • Streiff, J., Justice, C., & Camp, J. (2019). Escaping to cybersecurity education: Using manipulative challenges to engage and educate....
  • Sucharew, H., & Macaluso, M. (2019). Methods for Research Evidence Synthesis: The Scoping Review Approach. Journal of Hospital Medicine...
  • Sun, J. C.-Y., & Chen, A. Y.-Z. (2016). Effects of integrating dynamic concept maps with Interactive Response System on elementary school...
  • Svabensky, V., Vykopal, J., & Celeda, P. (2020). What Are Cybersecurity Education Papers About? A Systematic Literature Review of SIGCSE...
  • Thackray, H., McAlaney, J., Dogan, H., Taylor, J., & Richardson, C. (2016). Social psychology: An under-used tool in cybersecurity. Proceedings...
  • Tricco, A.C., Antony, J., Zarin, W., Strifler, L., Ghassemi, M., Ivory, J., Perrier, L., Hutton, B., Moher, D., & Straus, S.E. (2015)....
  • Tschakert, K. F., & Ngamsuriyaroj, S. (2019). Effectiveness of and user preferences for security awareness training methodologies. Heliyon,...
  • Tsokkis, P., & Stavrou, E. (2018). A password generator tool to increase users’ awareness on bad password construction strategies. 2018...
  • Veneruso, S. V., Ferro, L. S., Marrella, A., Mecella, M., & Catarci, T. (2020). CyberVR: An Interactive Learning Experience in Virtual...
  • Villasís-Keever, M.A., Rendón-Macías, M.E., García, H., MirandaNovales., M.G., & Escamilla-Núñez, A. (2020). La revisión sistemática y...
  • Visoottiviseth, V., Sainont, R., Boonnak, T., & Thammakulkrajang, V. (2018). POMEGA: Security game for building security awareness. Proceeding...
  • Volkamer, M., Renaud, K., Reinheimer, B., Rack, P., Ghiglieri, M., Mayer, P., Kunz, A., & Gerber, N. (2018). Developing and evaluating...
  • Wang, Y.-J., Tseng, S.-S., Yang, T.-Y., & Weng, J.-F. (2018). Building a frame-based cyber security learning game. Communications in Computer...
  • Wash, R., & Cooper, M. M. (2018). Who provides phishing training? Facts, stories, and people like me. Conference on Human Factors in Computing...
  • Weaver, B. W., Braly, A. M., & Lane, D. M. (2021). Training Users to Identify Phishing Emails. Journal of Educational Computing Research,...
  • Wen, Z. A., Lin, Z., Chen, R., & Andersen, E. (2019). What.Hack: Engaging Anti-Phishing Training through a Role-playing Phishing Simulation...
  • Wolf, S., Burrows, A. C., Borowczak, M., Johnson, M., Cooley, R., & Mogenson, K. (2020). Integrated outreach: Increasing engagement in...
  • Wolf, S., Cooley, R., Johnson, M., Burrows, A. C., & Borowczak, M. (2020). Constructing and refining engaging computer science outreach....
  • Yett, B., Hutchins, N., Stein, G., Zare, H., Snyder, C., Biswas, G., Metelko, M., & Ledeczi, A. (2020). A hands-on cybersecurity curriculum...
  • Zhang-Kennedy, L., Chiasson, S., & Biddle, R. (2016). The role of instructional design in persuasion: A comics approach for improving...
  • Zhang-Kennedy, L., & Chiasson, S. (2021). A Systematic Review of Multimedia Tools for Cybersecurity Awareness and Education. ACM Computing...
  • Zielinska, O. A., Tembe, R., Hong, K. W., Ge, X., Murphy-Hill, E., & Mayhorn, C. B. (2014). One phish, two phish, how to avoid the internet...