Cyber Security Awareness Week Research Articles

Guest Editor Introduction: Embedded Security Challenge

The Embedded security challenge (ESC) is the hardware security equivalent of what the Capture the Flag competition is for software security. It is the only student-run hardware hacking competition in the world, and has been an integral part of the Cyber Security Awareness Week (CSAW) held annually at New York University since 2008. CSAW began as a small, local competition with a handful of students in 2003 and since has grown to the largest student-run security event in the world, with about 20000 international participants competing for qualification to the final rounds of the event.

Stack Redundancy to Thwart Return Oriented Programming in Embedded Systems

With the emergence of Internet of Things, embedded devices are increasingly the target of software attacks. The aim of these attacks is to maliciously modify the behavior of the software being executed by the device. The work presented in this letter has been developed for the Cyber Security Awareness Week Embedded Security Challenge. This contest focuses on memory corruption issues, such as stack overflow vulnerabilities. These low level vulnerabilities are the result of code errors. Once exploited, they allow an attacker to write arbitrary data in memory without limitations. We detail in this letter a hardware-based countermeasure against return address corruption in the processor stack. First, several exploitation techniques targeting stack return addresses are discussed, whereas a lightweight hardware countermeasure is proposed and validated on the OpenRISC core. The countermeasure presented follows the shadow stack concept with a minimal hardware modification of the targeted core and an easy integration at the application level.

Profiling cybersecurity competition participants: Self-efficacy, decision-making and interests predict effectiveness of competitions as a recruitment tool

This paper presents the main results of a large-scale survey on cybersecurity competition participants in the past decade. 588 participants of the Cybersecurity Awareness Week (CSAW) competition were surveyed with measures of personality, interests, culture, decision-making and attachment styles in an exploratory study designed to identify the characteristics of cybersecurity competition participants. Subgroups analyses were performed to examine individual differences between self-proclaimed hackers and non-hackers, males and females, and cybersecurity employees versus students. Regression analyses were used to identify variables that influenced the extent to which cybersecurity competitions were effective at convincing participants to pursue a future career in cybersecurity. Cybersecurity participants who displayed higher self-efficacy, rational decision-making style, and more investigative interests were more likely to declare an interest in a career in cybersecurity after the competition.

Cybersecurity Competitions: The Human Angle

As a first step in a larger research program, the authors surveyed Cybersecurity Awareness Week participants. By better understanding the characteristics of those who attend such events, they hope to design competitions that will inspire students to pursue cybersecurity careers.