Hands-on and practical learning has been key to cybersecurity education and training success. Cyber Defense Exercises (CDX) are a common approach to training, testing, and verifying technical and soft skills. However, full-scale CDX implementation is also an expensive training event. In order to advance such exercises to the next level, CDX organizers should further focus on educational, psychological, and cross-domain relationships. The paper discusses and proposes a multidimensional approach for CDX that balances cognitive, emotional, and social aspects critical for successful interdisciplinary learning. We share our experience incorporating knowledge from well-known psychology theories to CDX. We derive and describe seven elementary ingredients if a CDX is to meet the interdisciplinary and critical thinking needs of defensive cyberspace operations.

The human aspects of cyber security are fundamental as these are interlinked with processes and technology in building resilience against an evolving and complex threat landscape. It is vital to teach future cyber security specialists sufficient knowledge about human aspects in order to strengthen the defences and defend against malicious actors. The challenges in the cyber security course and curriculum design in higher education arise from ambiguity of what is meant by “human aspects” in cyber security, and differing demands of a multitude of cyber security job profiles. As a result, choosing what human aspects knowledge and skills to teach and balancing this with technical content is a multiplex problem. We review the existing cyber security curricular guidance on the human aspects and perform a systematic literature review of academic research. The review covers what human aspects content is included in existing cyber security courses and curricula, what are the design philosophies and pedagogical approaches to teaching human aspects, and how the effectiveness of the content coverage and pedagogical approaches is evaluated in higher education with cyber security specialisation. The main findings are that although high-level guidance is available, there is no academic agreement and common vocabulary on the human aspects of cyber security. The research covering teaching human aspects is often very high level or focuses on a narrow topic (e.g., social engineering). The published research and sharing knowledge on the pedagogical approaches and evaluation varies in quality and is often published based on the USA’s universities’ experience. The interdisciplinary approach in cyber security, where human behaviour is a crucial component (i.e., human-centric cyber security), has been discussed for years. However, only when giving enough human aspects focus in the curricula and choosing appropriate pedagogical approaches will academia shape the future of cyber security education to achieve this goal.

Labor market analysis shows that there is a significant shortage of experienced cybersecurity professionals, and this trend is expected to continue in the future. In addition, young people who are reluctant to choose STEM subjects in school typically do not see cybersecurity as a part of their future because they believe it demands exclusive technical knowledge that is beyond their reach. We aimed to change this perception among students of the social sciences, assuming that by providing social science students with the basics of cybersecurity, it would be possible to raise their awareness and encourage them to consider this field as a potential career option. Our team has designed a concise technical course based on Kolb's model that employs experiential learning to provide students with a basic knowledge of ethical intrusion (penetration testing). During the 32-hour subject, cadet officers with no prior IT education experienced all the steps of hacking both into a remotely accessible and physically accessible computer, including initial reconnaissance, vulnerability scanning, exploitation, and privilege escalation. A hands-on practical task of breaking into a highly vulnerable remote computer allowed for the evaluation of knowledge and skills as well as the reinforcement of learning experiences. In order to assess how the students' perceptions of the cybersecurity profession have changed based on the theory of planned behavior, they were asked to provide feedback immediately after the course and one year later. The results indicate that the short, technically challenging, but practical course based on experiential learning had a significant and positive effect on participants' attitudes: they were substantially more likely to consider cybersecurity as a future career, and some of them began participating in other cybersecurity courses or activities. It is reasonable to assume, therefore, that providing similar technical courses to social science students will encourage them to pursue cybersecurity-related careers in the future.

Cybersecurity (CS) is a contemporary field for research and applied study of a range of aspects from across multiple disciplines. A cybersecurity expert has an in-depth knowledge of technology but is often also recognized for the ability to view technology in a non-standard way. This paper explores how CS specialists are both a combination of professional computing-based skills and genetically encoded traits. Almost every human behavioral trait is a result of many genome variants in action altogether with environmental factors. The review focuses on contextualizing the behavior genetics aspects in the application of cybersecurity. It reconsiders methods that help to identify aspects of human behavior from the genetic information. And stress is an illustrative factor to start the discussion within the community on what methodology should be used in an ethical way to approach those questions. CS positions are considered stressful due to the complexity of the domain and the social impact it can have in cases of failure. An individual risk profile could be created combining known genome variants linked to a trait of particular behavior using a special biostatistical approach such as a polygenic score. These revised advancements bring challenging possibilities in the applications of human behavior genetics and CS.