This chapter provides a case study where a systematic, organized method of storytelling, presented as the Story-based Learning model, is used to design a series of integrated and engaging activities for cybersecurity training (to protect computer systems and networks) that fosters deliberate practice and improves performance. To address the talent shortage in the global cybersecurity workforce, the client developed a blended curriculum designed to provide practical experience to prospective cybersecurity professionals. A key component of this curriculum was the capstone exercises, activities focused on application of the content introduced in the courseware. Essentially, this is a story of using stories, one of humanity's oldest technologies, to solve the problem of training and cultivating expertise in future cybersecurity personnel. Based on solid prior evidence supporting the use of stories to increase engagement and retention, this case study focuses on detailing the thought process used to reach this set of solutions, as captured by the Story-based Learning model.
TopOrganizational Background
The client for this case study was a large global technology company with a long history of innovation and training, with capabilities and expertise built over decades. The client recently also cemented a specialization in providing cybersecurity solutions. Through my affiliation with a globally recognized learning center of excellence, I had the opportunity to support the client in developing the cybersecurity curriculum at the heart of this case study.
While there were countless individuals and groups involved in the strategic planning, analysis, design, development, and implementation of the cybersecurity training curriculum, this case study only mentions the areas most significant to this case study, categorized as follows:
- •
Subject Matter Experts: The team of Cybersecurity Subject Matter Experts (often abbreviated as SMEs) that supported all aspects of the cybersecurity curriculum development and delivery.
- •
Analyst: Individual who worked with the Subject Matter Experts to conduct an upfront work analysis, detailing the tasks and skills performed by cybersecurity professionals on a daily basis, as well as answering clarifying questions by Instructional Systems Designers during development.
- •
Instructional Systems Designers: The team of Instructional Systems Designers (often abbreviated as ISDs) that I worked with for this project. We worked with the Subject Matter Experts to develop the cybersecurity training, but the Instructional Systems Designers also provided each other unwavering support and fresh perspectives throughout the process.
- •
Information Technology Infrastructure: The team of Information Technology (often abbreviated as IT) Infrastructure personnel who configured the computer network infrastructure and environment to support the development and delivery of the cybersecurity curriculum, in particular the various lab exercises.
TopSetting The Stage
Unfortunately, cybercrime is big business, to the tune of over $440 billion a year. Cybercriminals have grown increasingly more organized and aggressive, while the cybersecurity teams defending against such attacks have struggled to find qualified personnel. The fact remains that there continues to be a persistent talent shortage in the global cybersecurity workforce. One important reason for this dearth of qualified applicants was the past focus on hiring people with traditional technology degrees instead of “opening themselves up to applicants whose nontraditional background mean they could bring new ideas to the position and the challenge of improving cybersecurity” (Zadelhoff, 2017).
Recently, more companies have recognized that skills, knowledge, and willingness to learn can prove more vital than formal degrees. This turning point was a result of understanding that the characteristics critical to the success of cybersecurity professionals were not ones that taught in the classroom, including curiosity, problem solving, strong ethics, and risk management (Zadelhoff, 2017). When the prospective candidates start with these right characteristics, they are better positioned to complete a comprehensive cybersecurity training program that teaches the required technical and technological competencies, coupled with preparation to obtain recognized industry certifications. The client in this case study was one of these companies that recognized this attitude in closing the hiring gap in global cybersecurity professionals.
By embracing this attitude, the client sought to expand their role in providing broad-based, comprehensive cyber services. The learning solution at the heart of this case study was to develop a fully-functional, blended curriculum focused on providing practical experience to prospective cybersecurity professionals. The goal of the training program was to cultivate the new, and much needed, workforce required to secure the networks and systems of current and potential customers across the globe, including foreign governments, military, and large corporations.