Teaching Game Theory to Improve Adversarial Thinking in Cybersecurity Students

The ability to anticipate the strategic actions of hackers, including where, when, and how they might attack, and their tactics for evading detection, is a valuable skill for cybersecurity. Therefore, developing the strategic reasoning abilities of cybersecurity students is an important cybersecurity education learning objective. This paper proposes that basic game theory concepts should be taught to cybersecurity students in order to improve their strategic reasoning abilities. It details a pretest-posttest educational experiment that demonstrates that 2 h of basic game theory instruction results in a statistically significant improvement in students' abilities to anticipate the strategic actions of others. It also provides details of the game theory curriculum to help other cybersecurity educators replicate these results. Additionally, this paper suggests that another benefit of teaching game theory in a cybersecurity course is that it may fundamentally alter the way students view the practice of cybersecurity, helping to sensitize them to the human adversary element inherent in cybersecurity in addition to technology-focused best practices. This could result in a more naturally strategic-minded, and therefore better equipped, cybersecurity workforce.