October 2022 | Privacy & Cybersecurity | Office of the Chief Information Officer

Cybersecurity Champions: Leading by Example

Cybersecurity Champions make our campus community a little more cyber safe.

The “Cybersecurity Champions” program began in January 2022 with the goal of making our campus community a little more cyber safe.

Champions participate in monthly challenges designed to raise awareness broadly of privacy and cybersecurity issues and more specifically at the University of Illinois.

Participants are asked to encourage their coworkers to complete their online quarterly cybersecurity training, post information, or share information in team spaces with important cybersecurity messages. They also act as eyes and ears and can share questions or concerns related to cybersecurity back to the team at Technology Services.

Erin Metz is a member of the inaugural group of champions. She believes cybersecurity is an issue that she’s happy to help her coworkers with.

“I’m sure we have all been exposed to spam emails, lately more frequently, which is both frustrating and annoying. I’m here to help spread awareness. People of my generation were the first to have the internet. I think in general we have a good idea of what not to click, and I am happy to help others see that too,” she said.

Metz finds videos for the cybersecurity training program informative and funny, and they have been a good jumping off point for engaging others in the office with cybersecurity concepts.

“I particularly liked the training to create unique passwords. That one hit home the most. There was a lot of interest from others in my unit in figuring out how to use real words for passwords that are put together in a way that makes sense to them but are hard for others to figure out. I found that topic created a lot of good conversation,” Metz said.

Metz works in the Office of the Vice Chancellor for Diversity, Equity, and Inclusion, where she helps individuals with disabilities make their office work for them so that they can work safely and in the most productive way possible.

“We are in a fairly new office and several units occupy the same floor. We can spend a lot of time going back and forth to other locations within the office and are away from our desks during those times. A cybersecurity goal for our work group was not to leave information out in the open—to lock your computer when you walk away to prevent anyone walking past from seeing it, she said.” That was a simple fix that has made a difference in their level of security.

Metz also pointed out how pleased she was that the report spam button was introduced in Outlook email. “Having that feature is important. And my biggest takeaway is to get others to use that button and to just not click on things that do not look legitimate,” she noted.

Cybersecurity Training Specialist Sandy Bone says the program is geared towards those with no background in computers or cybersecurity. “One of our goals for the program is to engage with people across all of campus,” she said.

The monthly challenges provide ways to learn even more about cybersecurity best practices, share cybersecurity messages with coworkers, and earn prizes.

Champions receive a newsletter that contains their monthly challenge and additional information about things happening with the Cybersecurity Training and Awareness Team and more broadly with privacy and cybersecurity on campus.

Those who complete the challenges receive the month’s incentive giveaway item.

“The giveaways are really nice. And I already mentioned the videos are good. I would recommend that anyone who comes on board with the champions program take more of the training. The videos are short and effective,” Metz added.

Interested in learning more about the 2023 Cybersecurity Champions program? Staff and faculty will see application information in the November 2022 Work Secure newsletter. Or contact Sandy Bone at sandrad3@illinois.edu.

Opening a Window onto High School Cybersecurity Education

How can current and future generations help to ensure that technologies are created and used ethically? One way is effectively teaching students about cybersecurity and AI ethics. Associate Professor of Information Sciences Yang Wang and colleagues from the University of Illinois and other universities are interested in the topic and have been conducting research into how to improve instruction. Notably, their research team also has two high school students.

In online interviews, 16 U.S. high school teachers and several high school students shared their experiences in teaching and learning cybersecurity and AI ethics.

Findings about what topics high school teachers cover, the strategies and resources they use, and challenges they encounter were released in their paper, “How technical do you get? I’m an English teacher”: Teaching and Learning Cybersecurity and AI Ethics in High School.

The research is set for presentation at a premier international conference on computer security in early 2023. [IEEE Symposium on Security and Privacy 2023 (ieee-security.org)

A fundamental goal of cybersecurity ethics education is to prepare future decision-makers in the realm of cybersecurity. “This is an area where multiple ethical frameworks converge on issues including fairness, balancing the ‘good’ versus harm or risk, and the protection of innocent parties,” the researchers noted.

Teachers shared their struggles to inspire “an appropriate level of awareness and concern in their students in topics like cyber hygiene, personal autonomy, and data privacy.” Many teachers in the study described students’ overconfidence in their own ability to spot threats. Teachers also expressed that their students lacked awareness regarding online information, which can leave a person vulnerable to mis- and disinformation.

Teachers varied in their opinions about the reasons behind their observations. While some pointed to naivety, one teacher said:

“I think that’s something that takes a lot of time and understanding to develop, to think about how you participate within systems and how systems influence you […]. That’s a developmental thing. I don’t think it’s naive.”

Wang and colleagues concluded that their initial study demonstrates a need for more and better-quality cybersecurity/AI ethics instruction and that more research is needed to investigate their findings with larger samples and across broader swaths of the U.S. educational system.

Further, they recommend that “it would also be helpful to delve further into how teachers can best introduce AI/CS ethics into already-packed curricula.”

Wang and colleagues point to the fact that much current cyber education is grounded in ‘don’t-do-this-isms’. And that students seem to immediately tune out such messages. Not wanting to be lectured to by adults is one reasonable explanation for a certain level of apathy.

Provide more tools for teachers and make them integratable

Wang explained that from the interviewed teachers’ perspective, a common theme was a lack of tools or of support to allow teachers to cover cyber hygiene. While some cybersecurity education resources exist, it takes time to discover them. And then once discovered, it often is not easy for educators to incorporate them into curriculum.

Make it relatable and include students in the teaching

Wang explained that his colleagues are working on the next phase of research, which is helping to create the resources teachers want and students will engage with.

They conducted a workshop at a local high school where they designed a set of hands-on labs to educate students about privacy and security issues. Students were asked to create a public announcement or a short summary of a cybersecurity issue.

“It was fun to see students create different announcements. Evaluations afterwards showed that the students liked that activity. They had to use what they learned and then present it themselves. Only if you can teach something, does it show you understand it. Students know the ways that the content will be engaging for their peers,” Wang said.

“Teachable moments” can make a difference

“Our university is doing a great job creating a lot of education materials and short lessons. However, I think a lot of times people brush the ideas away because cybersecurity’s not a main concern in their daily life. When you go online your main task might be making a purchase, etc.,” Wang said.

Wang explained that there are some very good materials that train college students, yet they are usually for students in the STEM field.

“Arguably each student should have an awareness of these issues. The challenge is how to educate students in disciplines who don’t take computer classes,” he noted.

Wang believes what he and his colleagues learned from their work can be applicable to colleges. Teachers like to use recent events to illustrate things. Resources that allow teachers to easily use recent events as a springboard will be a good technique, he noted.

Wang teaches classes in computer security and in user experience and data science, and as he has started to mention current events in his instruction it catches people’s attention. “It’s a way to bring up these issues in non-CS classes. I use examples from this research [the examples that high schoolers created] in my own teaching. Students then immediately know what I am talking about.” he explained.

“Think about teachable moments. When cybersecurity events happen in the world, people are more likely to spend time on them. When you deliver and how you deliver them can build on real world events. That’s a good strategy,” he said.

Keep Learning and Stay Aware

Training and Vigilance Kept This Employee from Getting Scammed

Like most of us, Alissa Jones does not work in cybersecurity. Prior to coming to work at the University of Illinois, the cybersecurity training she received was word of mouth, and it contained only simple advice like, protect your password.

The quarterly cybersecurity training for UIUC employees has broadened her knowledge and ability to keep her personal and professional data safe.

And Jones says she was ‘saved’ by completing online cybersecurity training and the heightened awareness because of it. She shared her almost-incident with the Cybersecurity Training and Awareness Team.

“I literally got a call this morning during a meeting, and the voicemail was about ‘my student loans’ that I thought was real. I was going to call back over lunch, but after taking the module, it made realize the voicemail was likely a scam.

Sure enough, I did some research on the phone number they left me to call back before calling, and it confirmed it was a scam call.

I don’t know what headache you all saved me from if I had called them back, but you definitely saved me!!!”

Jones is a Visiting Instructional Design and Technology Coordinator in the College of Education, so has years of experience with training and how it is delivered and received.

“Working in education I think about how people learn,” she said. And she noted how she appreciates the ways that cybersecurity trainings consider different learning styles. “For me, it’s best to read something and have a reference to it.” Others have different preferences, such as listening to training or practicing something new to learn it.

“They do a good job of highlighting the everyday issues. Some I didn’t even know were an issue. It provides new information to me,” she added.

“You don’t know what you don’t know. The trainings make me feel more confident and secure about how to follow up. I now know how to report things. And training gives you the tools you need if something seems off.”

Training helps with your professional life

Cybersecurity modules demonstrate what to look out for, and Jones found it easy to apply what she learned.

Scammers take advantage of inattention and of our tendency to gravitate toward the familiar. Jones appreciated the reminder to be vigilant.

“Working at the U of I, your name is out there. My email is tied to a conference website. I get emails from people looking to help us plan our conferences. I am more sensitive about looking at those emails because they could be phishing. I also do more research. Like for U of I emails, if I don’t know them and if I can’t find that person in the UI directory, then it might be phishing.”

Cybersecurity training provides help with digital life beyond the university

Training also helped her to be aware of messages from recognizable entities.

Scammers can use a variation of the email by changing a dot or a letter. Unfortunately, this scam happened to her mom. “She received an email about a ‘going out of business’ sale from a store she knew was closing. She visited the website and noticed the shopping experience was different. She went ahead and bought her items, and then sent me the email about the sale. I looked at the email address and based on the training I realized it was likely a scam. (Over time we learned it definitely was a scam!) But because of my training, she was able to report the fraud quickly to her bank and hopefully help others.” Jones said. Anyone with a valid University of Illinois email address can take cybersecurity training at https://go.uillinois.edu/securitytraining.

Complacency can result in compromise

It can happen to anyone, and training is a wonderful way to stay ahead of scammers with bad intentions, Jones noted.

“Don’t brush off the training. I work a technical job and am careful, but things are getting so sophisticated, it is hard for even an expert. Keep learning and stay aware.”