Emphasising human connections through security mentorship
James Thorpe
Share this content
Building cyber-education pathways with mentorship, enthusiastic curiosity and collaboration, by Timothy King, WIL Digital eLearning Faciltator, Cyber Education & Deeptech Specialist, ICTC.
One of the biggest challenges I face in engaging educators and students with cybersecurity is taking panic out of the equation. Nobody can learn if they are panicking.
In the past two years, I have been seconded from the classroom after over twenty years developing nationally recognised computer engineering students in subjects ranging from 3D animation and programming to information technology and cybersecurity.
I brought the lessons learned from this work in our rural high school to my secondment with the Information & Communications Technology Council of Canada (ICTC).
Fear of breaking technology limits how many people interact with it. In addition to the technology of itself, marketing often leverages fear and ignorance to sell.
One of the first things I do with the 13-year-olds new to my program is have them physically build desktop PCs and networks to demystify the technology.
Tactile learning like this goes a long way towards building confidence.
Shaping cybersecurity education
In 2017, we tackled CyberTitan, Canada’s national student cybersecurity competition in its inaugural year.
CyberTitan is the Canadian centre of excellence in the international US-based CyberPatriot competition which uses compromised virtual machines to teach students real world analysis and repair skills across a variety of operating systems.
There is also a secure networking architecture component using Cisco’s Packet Tracer software.
My industry background is in information technology so, like my students, this was our first foray into cybersecurity.
Modelling enthusiastic curiosity mindsets when analysing broken systems was imperative, even when I had internal doubts myself.
Emphasising the team-based nature of the competition was also essential. Students work in teams of four to six, analysing and repairing these corrupted VMs, so just like in applied cyber, no one works alone.
We were already provincial champions in IT & Networking at Skills Canada competitions, so the technology didn’t phase us, but it did begin our growth from building the technology box most people exist in to stepping outside it in order to analyse how these systems might be abused.
It was pedagogically fascinating work that prompted me to gain my first technology certification in six years as a CCNA Cyber Operations Instructor.
After we finished fifth in Canada in our first year, I made a point of encouraging the junior girls to form a team.
They became the first ever all-female team to attend the CyberTitan national finals in 2019 and did it again in 2021. This drove diversity in our program. From 2020 onwards, all of our competitive senior teams were gender diverse.
We also discovered that neurodivergent students provided advantages when it came to the out-of-the-box thinking that cyber demands. From 2020 onwards, we often had more neurodivergent students than not on all of our teams.
In 2023, ICTC asked if I’d like to be seconded out of the classroom to promote cybersecurity education nationwide.
This prompted a new chapter in my teaching practice where I had the rare opportunity to teach in other Canadian jurisdictions.
Having been in front of students from Newfoundland in the Atlantic to British Columbia facing the Pacific, I see the anxiety that prevents many from tackling cybersecurity in classrooms.
I applied the lessons learned in my teaching: Offer cyber range simulation to face real world situations without fear of failure, emphasise collaboration and teamwork and encourage teachers to be enthusiastic, curiosity-driven role models when exploring this potentially unsettling subject.
I have stayed in touch with many of my graduates who are now in post-secondary or industry cyber roles.
At the 2023 CyberTitan national finals at the Cybersecurity & Privacy Institute at the University of Waterloo I ran into Cameron, who captained our first team back in 2017.
He was wrapping up his computer science undergrad at Waterloo and was wondering what was next.
At nationals, he got introduced to professors running cyber-research and is now neck deep in the CPI IoT research lab doing post-graduate research.
In 2024, the federal funding for my secondment at ICTC was going to end before the close of the school year. I’d been looking into how to teach emerging quantum technologies which led me to Ella Meyer at the University of British Columbia.
She arranged a quantum learning week for myself and other game developers in hopes of building a quantum arcade to introduce concepts, which led me to Louise Turner and the Quantum Algorithms Institute.
Louise is focused on preparing Canadian business for the quantum revolution and asked if I’d like to develop cyber readiness with them.
To prepare for that, I found the Global Forum for Cybersecurity Excellence’s call for research for its inaugural Global Conference for Cyber Capacity Building that would take place in Accra, Ghana at the end of November 2023.
How better to become familiar with quantum readiness in cyber than by doing research on it? Juggling two secondments and doing the research was a handful and I realised I needed help.
At that point a former student, another Louise Turner, got in touch asking about possible internships, so I asked if she’d be willing to co-author the GFCE research with me.
One of the challenges cybersecurity faces is how to get young people into the field. With many not experiencing any cyber-education while in public school, the pathway is hidden.
I was fortunate enough to have graduates heading into the field thanks to our competition efforts. Louise was going into her third year of Queen’s University’s first cohort for cybersecurity-focused computer science.
This kind of mentorship provides opportunities and solidifies pathways and it’s often ignored in cybersecurity.
In becoming familiar with the field, I’ve come to realise that hands-on experience is much more important than academics – cybersecurity is more of an apprenticeship than an academic pursuit.
Mentoring young people in the field is essential if we’re to develop a relevant approach to cyber training.
Louise and I travelled to Ghana, presented our research, and then, thanks to continued support from Louise at the Quantum Algorithms Institute, we found ourselves expanding our research and presenting it from coast to coast in Canada and also in Mexico.
On the back of all this, ISJ awarded me the mentorship award in 2024.
Thinking outside of the box
What are the lessons learned? We need to emphasise human connections through mentorship in cybersecurity.
We need to apply industry standard immersive simulation technology when introducing students to cyber to take the fear out of it while also aligning them with real world situations.
We also need to let students know that cybersecurity isn’t lone wolf work.
It happens in teams and learning the collaborative skills needed for them to communicate and work together effectively is paramount.
I often hear students say: “That’s not nearly as complicated as I thought it was going to be,” when they resolve a breach – and that’s a big secret in cyber.
Hackers don’t look for the most difficult way in, but usually go with something that has been overlooked in system design.
Being able to think outside of the box and consider problems from creative angles is why you’ll often find some of the strongest cyber students coming from creative disciplines.