4 Tips From A First-Time Cybersecurity Instructor

Last fall, I was contacted to teach the first Cybersecurity Boot Camp at the University of Denver. The boot camp began in November, and we just finished this past May. Over the course of the program, I found my classroom presence getting better and better, and I wanted to share some of the reasons why I think I was improving. 

1. Don’t Be Afraid of Complexity

At the end of the boot camp, my students gifted me a coffee mug with the phrase It depends on it. Throughout the program, this statement was one of my most common responses to their questions. The world we live in isn’t black and white, and our answers to student questions should not be limited to only Yes or No.

When asked a good question that has multiple angles to it, I like to start a conversation around all sides to really dig into the why of something. This is not to say that knowing the how and what isn’t important—it absolutely is. It’s just that we as instructors need to be willing to go deeper. If my students come out of the class knowing, for example, how to write a firewall or Snort IDS rule, but they can’t explain why it is or is not a good rule, then I haven’t done my job.

In a real-life scenario there are very few absolute answers, and being able to understand and articulate the many sides of an issue offers real-world returns. Working through these with the students presents a good opportunity for them to offer their input, paints a more realistic vision of the world, and helps them understand how to work through problems.

2. Remember the Whiteboard!

We’ve all gotten used to using PowerPoint or Google Slides to drive our presentations. While they are tremendous tools that help to present some great content, we shouldn’t limit ourselves to them, or to live demonstrations on our laptops.

Over the course of the boot camp, I became a bigger fan of using the whiteboard. Sometimes walking through an exercise or two on the whiteboard step-by-step was just easier for the students to follow, versus moving through slides one by one. The whiteboard slows us down (a good thing for students who struggle with pace) and provides more opportunity to explain steps both in-depth and in alternate ways. I personally found this to be especially beneficial in working through topics like programming looping structures (“while”, “for”) and network flows (firewalls, routing).

I have a tendency to speak fast when I’m presenting material. While a degree of speed is necessary to fit in all the material covered in the class, my rapid style doesn’t always align with the pace that the students need to follow during instruction. Taking advantage of something that naturally slows me down, and that provides another method of presenting, can only lead to good results.

3. Encourage Students to Help and Learn from Each Other

At the beginning of the boot camp, I was hesitant to encourage or ask some of the stronger and faster individuals in the class to help their fellow students. I didn’t want it to look like our instructional team wasn’t able or willing to assist them with any areas they were struggling in. However, there are only a few of us instructors and TAs while there are a lot of students, and we cover a good amount of material that is brand new to most of them. Taking advantage of the wide range of students’ knowledge and past experiences (especially in things like programming) and encouraging them to work with and help each other made a massive improvement in our classroom. 

One added side effect was that it helped the students get to know each other a bit better and to talk with others they might not normally be inclined to work closely with. We ended up with a fairly tight-knit class at the end.

Plus, I’ve always found that trying to teach others how to do something has helped me improve my own knowledge and understanding of the topic, and I’m sure it helped our students, too.

4. Prepare Options to Scale Activities Up/Down Ahead of Time 

Boot camp students come to the program with a wide range of skills and backgrounds. Naturally, some of them end up completing the classroom activities well before others. In some cases, they would help their fellow classmates (see #3 above), but in other cases, I would offer them some additional challenges. In a similar vein, some students would struggle with an activity and would either need it simplified or some additional time to complete.

I found it helpful to have some options ready ahead of time for scaling the difficulty level of most activities up or down. For the struggling students I might have them focus on the core of an activity, or I might provide stronger or more hints. For the more proficient students, this might involve adding a “Bonus Challenge” option. This tactic worked particularly well for writing firewall and/or IDS rules (e.g. “Do this in one rule instead of two.”), forensics (“Find another way to get the same information.”), Python and shell programming (“Write the same function in only 3 lines instead of 6.”), and penetration testing (“Now find two other attack methods that accomplish the same goal.”).

Having this flexibility planned ahead of time allowed me to not have to think on the spot if someone needed an additional challenge, and similarly to be prepared to make sure the students who were struggling still had good opportunities to practice the most important parts of the lesson.

These four insights went a long way toward helping me lead a cybersecurity boot camp, and I hope they can be useful to others who are already in the classroom or those who are considering becoming an instructor in the future. 

Andrew Scharlott teaches for the University of Denver Cybersecurity Boot Camp.