“Think about the existing training models,” Ghazinour, an assistant professor and chair of the cybersecurity department at State University of New York at Canton, told Government Technology Thursday. “You read the pages, maybe watch some videos, and answer multiple choice questions. It’s ineffective, outdated and really does not change behavior.”
To focus on the human element of the problem, in 2019 Ghazinour started a collaboration with SUNY Canton and the SUNY Research Foundation to develop a different method for teaching cyber awareness: video games. Out of that came his private cybersecurity training company, CyberSpara, and its DigitalPASS (Digital Privacy and Security Simulation) software.
Like a flight or driving simulator, it allows users to make major mistakes without paying a tremendous price, Ghazinour explained. The user begins the game with a made-up identity to protect their privacy in real life. The setting can be a school, home or anywhere else students would frequent, depending on what the teacher or administrator selects, and the game can be customized to focus on specific awareness areas like phishing or strong passwords. The game provides no instructions as the user navigates their way through a series of decisions involving social media use, texts, emails and other online activities. Users play against peers and computer-generated opponents, gaining points for responsible behavior and losing them for irresponsible behavior, Ghazinour explained.
Ghazinour, who also heads the Advanced Information Security and Privacy Research Lab at SUNY Canton, has so far received about $500,000 in public and private grants for this project, with the larger awards coming from the National Science Foundation and the SUNY Technology Accelerator Fund (TAF). He’s awaiting future grants to develop versions of the game for private- and public-sector employers. He said the same artificial intelligence engine he built will power all future variations of the game.
According to a 2022 news release from the SUNY Research Foundation announcing Ghazinour’s project, TAF helps “bridge the gap” that SUNY researchers face when trying to commercialize their innovations. TAF covers costs for feasibility studies, testing and prototyping to help attract potential investors.
Ghazinour tested the earliest version of the game between 2019 and 2020 in northeast Ohio. A sample of 50 students between grades six and 12 played one round and completed pregame and postgame assessments containing the same questions. Thirty percent of them displayed increased cyber awareness in the postgame assessment, he said. Moreover, students provided valuable feedback and convinced the professor to add a feature allowing users to be “bad guys” who hack systems and steal personal information.
“That was a light bulb,” Ghazinour said.
He said future versions of the game will incorporate different challenges for employment training, such as peer pressure situations in a defense contractor setting, or federal privacy regulations for health-care workers in a medical office. CyberSpara recently made a deal with the Griffiss Institute, a U.S. Department of Defense contractor in Rome, N.Y., and Ghazinour is also talking to representatives from Kent State and Purdue universities.
As for the K-12 space, Ghazinour is optimistic that this technology will catch on in Canada and Europe as well.
“We’re completely ready for the international market,” he said. “I think people will agree with our theme: There is only so much you can do with technology. The rest is changing minds.”
