Teaching human-centered security using nontraditional techniques

Computing science students amass years of programming experience and a wealth of factual knowledge in their undergraduate courses. Based on our combined years of experience, however, one of our students' abiding shortcomings is that they think there is only one correct answer to issues in most courses: an idealistic stance. Human-centered security, as well as other areas, requires students to understand that they have to weigh up a number of different possible solutions, and satisfice, rather than choose the one that is undeniably the best. In other words, they need to adopt a more realistic stance. Lecture-based teaching cannot develop this facility, due to its inability to engage students deeply with the issues and possible solutions. We argue that depth (in terms of understanding the complexity and issues involved) as well as breadth (in terms of appreciating the different positions taken by users on these issues) are essential for developing the realistic stance. This article reports on an instructional design that was used to help students become more realistic in their decision making. The design is based on seven educational strategies that, in tandem, help students to see the depth and breadth of topics in the course. We detail the instructional design and its application to three topic areas in the course, and report on the outcomes. We found evidence that students did indeed develop the depth and breadth we were hoping for. In concluding, we reflect on the design and the positive result, and propose changes to further improve the course