Mandated Cybersecurity Education in K-12 Schools

Jason Pufahl 00:31
Somehow, we always seem to get there. But, so North Dakota recently passed a bill requiring mandatory computer science with some cybersecurity education, so requiring elementary school and high school students to have some computer science, a computer science course, and some curriculum that would teach them about cybersecurity and the risks, right?

Steven Maresca 01:01
Notably, notably, first state in the entire country to do so, which I didn’t expect North Dakota to be the one, but good for them.

Jason Pufahl 01:08
They’re setting the tone.

Matt Fusaro 01:10
What else they lead in? I’m not sure. Anything good?

Jason Pufahl 01:15
We don’t know.

Steven Maresca 01:18
Destination for Badlands.

Jason Pufahl 01:21
That’s a South Dakota, right?

Steven Maresca 01:22
Oh, well.

Jason Pufahl 01:23
Man, Steve.

Matt Fusaro 01:24
Oh, I guess they’re finally on the map.

Jason Pufahl 01:25
They’re, they’re on the map. I mean, it is interesting. So we certainly, cybersecurity education, security awareness training, it’s something that we do a lot, typically for companies, you know, and then and there’s some requirements there as a result of cyber liability insurance and some other regulations. But it’s interesting to see a state push this for their student body. And let’s face it, I think it makes a lot of sense for them to have a sense of what the risks are, you know, personally, I don’t think kids are as privacy minded as they should be. And I don’t, I don’t think they really understand the threats that are out there.

Steven Maresca 02:03
I mean, it’s it’s not as though the notion of teaching these skills has been absent from curricula, it’s just not necessarily a specific focus. I think it’s regularly the case that school systems try their best to equip students with, you know, knowledge about how to interpret information, for example. I distinctly remember discussion about Wikipedia and the, the risk of Wikipedia, but the same sort of thought process is attached to this, you know, understanding whether, you know, things in front of you are real or not, or whether they represent a risk, I think it’s a good thing. To K through middle school, are just required to have some sort of miscellaneous educational experience that high schoolers are required to have actually one real credit worth of, of classes. I think that’s good. You know, they have to have it in order to graduate unless they have some sort of, you know, exemption.

Matt Fusaro 02:03
Yeah. And it’ll be interesting to see how, how they can help support this type of initiative. You know, a bit back when I was in high school, you know, we ran into this problem where the programs that we had were actually cut, because the, the one person that was able to teach this material ended up having to teach math.

Steven Maresca 03:21
Right.

Matt Fusaro 03:22
So, by the time I had gotten to that point where I was actually able to take those classes, I wasn’t able to, because they were they were cut. See, I can foresee a lot of school districts just not having access to people who understand this information or be able to do it.

Jason Pufahl 03:37
So, so it makes you wonder, then, the medium that they use, is it going to be canvas style courses, your sort of more common LMS style courses, are they going to partner with some company that does video-based security awareness training? I think it’s unlikely they’ll be able to bring security professionals in to teach, you know, the total of their student body.

Steven Maresca 04:01
But you know, co-op programs and things like that are really, really common in high schools, with local area colleges and things like that, it might be a really good, you know, intersections between the folks who have that skill set or are paid to do it by colleges, helping out in the actual school systems. I imagine there’s a path there.

Jason Pufahl 04:21
So I think I mean, I think you’re gonna have to look at probably a couple of different, maybe levels of, of education, you know, educating your K-5 population, K-6, whatever, is certainly going to be different than providing that curriculum to a high schooler, and I think we actually partnered with the Center for Cyber Safety and Education, which was a piece of (ISC)2 for sort of people in the security space, I’m sure are familiar with that. And they had a whole program where they used Garfield to train young children right, elementary school children, on risks, risks on, you know, not responding to emails from people that you don’t know, risks about not sharing information over social media. I mean, I think it’s commonplace now for kids of that age to have social media. It was a great program. I think ultimately, that specific program was cut, but I think is an example of the types of things that you can do with those younger audiences that you probably can’t do with older audiences.

Steven Maresca 05:26
I do think there’s some good content out there that is, you know, Garfield being a cartoon, things that are accessible to younger audiences. And honestly, it’s what makes sense for that type of audience as well. It’s a dry subject, it has to be made more personal and more entertaining, otherwise, it’s not likely to stick.

Matt Fusaro 05:47
And maybe using more updated characters.

Steven Maresca 05:50
But perhaps, Garfield was available for licensing.

Matt Fusaro 05:54
Yeah, there you go.

Jason Pufahl 05:55
Yeah, for a good reason.

Steven Maresca 05:56
So, on this note, I will be interested to see what North Dakota and any other jurisdictions that are pushing this come up with for curriculum, what the, you know, the educational assistance, co-ops and so forth actually bring to bear because it can only help. It’s a void right now in the educational space.

Jason Pufahl 06:20
Well, and they need something built out by what, January of 24?

Steven Maresca 06:23
July, 2024.

Jason Pufahl 06:26
July of 24.

Steven Maresca 06:26
Yeah. I think in preparation for that, that fall.

Jason Pufahl 06:29
That would make sense. So they have about a year, in putting curriculum together in that timeframe is, you know, I’m sure going to be a challenge. So I would expect, you know, some of the vendors that currently play into place in this space, to benefit.

Matt Fusaro 06:41
Oh yeah, they’ll have offers for sure. Yeah, I’d be surprised if there weren’t several, within the next year.

Jason Pufahl 06:49
So I think this is probably just an introduction to the idea that, you know, there are states now that are starting to talk about more formal education.

Steven Maresca 06:57
I, I’m particularly interested in any states or districts that try to find people in their community that are already technically adept to bring in some of that skill set, because for example, makerspaces, hackerspaces, those are staff of volunteers who are enthusiastic. They often come from fields that are, you know, education adjacent, and things like that. And they can bring some tangible things to the conversation. It’s probably a really worthwhile area to tap for, at the very least people to bring in for instructors and things of that variety who are qualified.

Matt Fusaro 07:30
Yeah, I think they really should, should work on reaching out to community like that. Because yeah, you’re right. There’s lots of people who find out there.

Jason Pufahl 07:37
And I think there’s a lot of security professionals who would feel that that’s a good place to spend their time. I mean, educating the the younger people on real risks that, frankly, they just can’t, they can’t understand yet, right. So it’s really valuable to teach them early. I do think there’s a willing population out there, coordinating them and doing the legwork to get them involved, I’m sure would take a little bit effort. But you know, honestly, I, we joke a little bit at the beginning about North Dakota leading the charge on this, but I do hope that we start to see some other states push this because I think it really is important. It’s really interesting to see it hit, and, you know, having been, having been able to participate with Vancord in that West Haven School District, and seeing kind of the engagement of the students through a program that was tailored to their level. It was great. So I really think there’s, you know, there’s some, there’s some really good potential outcomes here.

Matt Fusaro 08:35
Yeah, I think it kind of drives home the fact that this type of education is just as important, especially these days as math and science, all the other required areas that are in there. So now it’s kind of a almost a protected silo now, where it can’t just be cut out, because you don’t want you want to pay for it, right.

Steven Maresca 08:53
We’ve talked about this before, in broad strokes. Most of cybersecurity awareness is familiarity and critical thinking skills, right. They are innate to the environment that we’re talking about. And anything that improves that for the younger set of kids is going to equip them more for the future that lies ahead.

Jason Pufahl 09:15
So, you know, if anybody’s interested in looking more into it, House Bill Number 1398, North Dakota, reasonably short, is a quick read gives you a sense of what they put together. We think it’s a, it’s a good idea. It’ll be interesting to see how it actually comes together over the next year. Yep, any questions for us, certainly feel free to reach out. I hope we answered a couple of burning questions around cybersecurity education in the K-12. And as always, we hope you got value out of this. Thanks for listening.

09:45
We’d love to hear your feedback. Feel free to get in touch at Vancord on LinkedIn or on Twitter at Vancordsecurity. And remember, stay vigilant, stay resilient. This has been CyberSound.