Evaluation of the offensive approach in information security education

Abstract. There is a tendency in information security education at universities to not only teach protection measures but also attack tech-niques. Increasingly more universities offer hands-on labs, where students can experience both the attackers ’ and the administrators ’ view. Getting to know the attackers ’ view is thought to lead to a better understand-ing of information security and its problems compared to teaching only strategies for defense. This paper analyzes the situation of information security education at German and international universities. We present a method to measure knowledge in information security and – using this method in an em-pirical study – evaluate the offensive teaching approach. Analysis of the empirical data gathered in the study shows a tendency in favor of the offensive approach compared to the classic defensive security education.