Teachers’ perspectives and practice of cybersecurity education in primary schools

Abstract Digital technology is a part of children’s everyday lives, yet very little known about teachers’ perceptions and practice of cybersecurity education in primary education. This study aimed to shed light on this, focusing primarily on children's password practices. A questionnaire was distributed to primary school teachers across Scotland, with 114 teachers across 14 local authority areas responding. The questionnaire sought to identify the aspects of cybersecurity teachers taught, to what ages, their own perceptions and confidence in cybersecurity education, and potential teaching enhancements. The questionnaire was mostly quantitative with predefined options but included a small qualitative section to gather open-ended responses. Results indicate that cybersecurity education in primary school centres around passwords, with phishing and hacking predominantly taught only to older age groups. Teachers reported several problematic password creation behaviours including children not creating their own passwords, creating weak passwords and including self-relevant information. In relation to authentication, forgetting was a pervasive issue across all age groups, prompting teachers to employ various support strategies that potentially exacerbate poor password practice. Teachers identified various cognitive skills that they feel contribute to the challenges children face in creating, remembering, and authenticating passwords, including literacy skills, keyboard proficiency, problem-solving, working memory, and long-term memory. There were important developmental trajectories for teaching, problematic password practice, and proposed cognitive skills. Finally, teachers expressed a need for additional training, age-appropriate resources, and curriculum support for teaching cybersecurity to primary-age children.