Introducing systems thinking as a framework for teaching and assessing threat modeling competency

Computing systems face diverse and substantial cybersecurity threats.To mitigate these cybersecurity threats while developing software, engineers need to be competent in the skill of threat modeling.In industry and academia, there are many frameworks for teaching threat modeling, but our analysis of these frameworks suggests that (1) these approaches tend to be focused on component-level analysis rather than educating students to reason holistically about a system's cybersecurity, and (2) there is no rubric for assessing a student's threat modeling competency.To address these concerns, we propose using systems thinking in conjunction with popular and industry-standard threat modeling frameworks like STRIDE for teaching and assessing threat modeling competency.Prior studies suggest a holistic approach like systems thinking can be suitable for understanding and mitigating cybersecurity threats.Therefore, the purpose of this study is to develop and pilot two novel rubricsone for assessing STRIDE threat modeling performance and the other for assessing systems thinking performance while conducting STRIDE.To conduct this study, we piloted the two rubrics mentioned above to assess threat model artifacts of students enrolled in an upper-level software engineering course at Purdue University in Fall 2021, Spring 2023, and Fall 2023.Our results reveal that students who had both systems thinking and STRIDE instruction identified and attempted to mitigate component-level as well as systems-level threats.On the other hand, students with only STRIDE instruction tended to focus on identifying and mitigating component-level threats and discounted system-level threats.Our work contributes to the engineering education community by: (1) describing a new rubric for assessing threat modeling based on systems thinking; (2) identifying trends and blindspots in students' threat modeling approach; and (3) envisioning the benefits of integrating systems thinking in threat modeling teaching and assessment.