Towards Improving Online Security Awareness Skills with Phishing and Spoofing Labs

It can be especially hard for novices to examine their online browsing habits, or to be aware of the dangers related to online security. In this paper, we describe laboratory exercises designed to improve awareness of online security, in addition to teaching cybersecurity knowledge and skills. The lab exercises were used as a part of an information security fundamentals course for IT students with none or only novice experience in the field. These lessons are suitable for both delivery in the classroom and online in a virtual laboratory environment. The lab exercises were developed using the design science research methodology (DSR). Following DSR principles, the evaluation of the developed material was done by extracting observations from student reports. The thematic analysis method was used to process the data. The evaluation of the student learning reports revealed that the labs and the course were successful in the following ways: Improving security knowledge, improving critical thinking skills, and improving security awareness. Students also gained hands-on cyber awareness skills by analysing metadata in messages. Additionally, the material was perceived as useful for future working life.