Computer Security Education Research Articles

Bad Tools Hurt: Lessons for teaching computer security skills to undergraduates

Understanding why developers continue to misuse security tools is critical to designing safer software, yet the underlying reasons developers fail to write secure code are not well understood. In order to better understand how to teach these skills, we conducted two comparatively large-scale usability studies with undergraduate CS students to assess factors that affect success rates in securing web applications against cross-site request forgery (CSRF) attacks. First, we examined the impact of providing students with example code and/or a testing tool. Next, we examined the impact of working in pairs. We found that access to relevant secure code samples gave significant benefit to security outcomes. However, access to the tool alone had no significant effect on security outcomes, and surprisingly, the same held true for the tool and example code combined. These results confirm the importance of quality example code and demonstrate the potential danger of using security tools in the classroom that have not been validated for usability. No individual differences predicted one’s ability to complete the task. We also found that working in pairs had a significant positive effect on security outcomes. These results provide useful directions for teaching computer security programming skills to undergraduate students.

Leveraging a cloud‐based testbed and software‐defined networking for cybersecurity and networking education

AbstractNowadays, real‐world learning modules become vital components in computer science and engineering in general and cybersecurity in particular. However, as student enrollments have been dramatically increasing, it becomes more challenging for a university/college to keep up with the quality of education that offers hands‐on experiment training for students thoroughly. These challenges include the difficulty of providing sufficient computing resources and keep them upgraded for the increasing number of students. In order for higher education institutions to conquer such challenges, some educators introduce an alternative solution. Namely, they develop and deploy virtual lab experiments on the clouds such as Amazon AWS and the Global Environment for Network Innovations (GENI), where students can remotely access virtual resources for lab experiments. Besides, Software‐Defined Networks (SDN) are an emerging networking technology to enhance the security and performance of networked communications with simple management. In this article, we present our efforts to develop learning modules via an efficient deployment of SDN on GENI for computer networking and security education. Specifically, we first give our design methodology of the proposed learning modules, and then detail the implementations of the learning modules by starting from user account creation on the GENI testbed to advanced experimental GENI‐enabled SDN labs. It is worth pointing out that in order to accommodate students with different backgrounds and knowledge levels, we consider the varying difficulty levels of learning modules in our design. Finally, student assessment over these pedagogical efforts is discussed to demonstrate the efficiency of the proposed learning modules.

A Study on the Design and Application of Fictional Storytelling in Online Learning of Computer Security

Computer security is an important part of the computer science (CS) curriculum in all kinds of universities. Although the educational approach tends to be highly technical and practical, it cannot be avoided that some understanding and memorizing of the core concepts is necessary beforehand. One method that has been found to work in favor of human psychology, and of special interest in the case of online learning, where student motivation is at a higher stake, would be to present such content as memorable and relatable situations to the reader, using some form of fictional storytelling. However, this approach must always serve its educational purpose first, following a set of sound design principles. This paper presents a study including 111 participants to evaluate the convenience of using a digital book called the “novelette”, which relies on storytelling, to teach computer security concepts in the CS degree of Universitat Oberta de Catalunya (UOC), a 100% online university. The study involved two questionnaires to gather quantitative and qualitative information about the format, content and students’ perception. This study shows that the validity and usefulness of this approach is on par with traditional ones, but also has a higher impact on student motivation and self-perception of the acquired knowledge.

Automatic Challenge Generation for Teaching Computer Security

Computer Security is an increasingly important area, considering the sophistication and increase of threats present in the digital world. The need for information protection contrasts with the lack of professionals and the limited space dedicated to the area in Information Technology (IT) courses. Games and competitions have been used to motivate Computing students to improve their practical knowledge on the subject and also to foster the interest of potential students and professionals in Security. The creation of these games requires specialized knowledge to develop new problems, since the novelty of these games is important to reach the desired level of difficulty and to ensure competitiveness. This work proposes the use of randomization to generate problems and entire competitions in an automated way, obtaining exclusive instances of problems for each player. A tool for generating challenges was developed as proof of concept to evaluate the proposal. Competitions with automatically generated problems were held with undergraduate and continuing education students, at two different institutions. The performance in the competitions and the perception of satisfaction, interest and learning of the involved students were analyzed. The results show that the automatic generation of challenges is feasible and the use of competitions to teach Computer Security is motivating and effective for didactic purposes.

Design and Learning Effectiveness Evaluation of Gamification in e-Learning Systems

This paper proposes a gamification design model that can be used to design and develop gamified e-learning systems. Furthermore, a controlled and carefully designed experimental evaluation in terms of learning effectiveness of gamification is offered. The experiment was conducted with 44 participants randomly assigned to an experimental ‘gamified’ condition and a controlled ‘non-gamified’ condition. In both conditions the same learning material, to teach computer security, were used. The main difference between the two conditions was the integration of gamification in an e-learning system designed based on the proposed model. The results indicate that learning using the gamified version of the e-learning system produces better short-term and medium-term learning gain than learning using the non-gamified e-learning version. Future avenues of research are also provided.

Effective Adaptive E-Learning Systems According to Learning Style and Knowledge Level

Aim/Purpose: Effective e-learning systems need to incorporate student characteristics such as learning style and knowledge level in order to provide a more personalized and adaptive learning experience. However, there is a need to investigate how and when to provide adaptivity based on student characteristics, and more importantly, to evaluate its value in learning enhancement. This study aims to bridge that gap by examining the effect of different modes of learning material adaptation and their sequences to the learning style and knowledge level of students in e-learning systems. Background: E-learning systems aim to provide acceptability and interactivity between students, instructors, and learning content anytime and anywhere. However, traditional systems are typically designed for generic students irrespective of individual requirements. Successful e-learning systems usually consider student characteristics such as learning style and knowledge level to provide more personalized and adaptive student-system interaction. Methodology: A controlled experiment was conducted in a learning context with 174 subjects to evaluate the learning effectiveness of adaptivity in e-learning systems. Contribution: The main contributions of the paper are threefold. First, a novel adaptive approach is proposed based on a specific learning style model and knowledge level. Second, the approach is implemented in an e-learning system to teach computer security, the application domain. Third, a rigorous experimental evaluation of the learning effect of the adaptive approach is offered. Findings: The results indicate that adaptation according to the combination of learning style and knowledge level produces significantly better learning gains, both in the short-term and medium-term, than adaptation according to either trait individually. Recommendations for Practitioners: Practitioners should consider the combination of learning style and knowledge level when delivering and presenting learning material to their students. Recommendation for Researchers: Researchers should consider sound educational models when designing adaptive e-learning systems. Also, rigorous and carful experimental design evaluations should be taken into account. Impact on Society: Universities and e-learning industries can benefit from the proposed adaptive approach and the findings in designing and developing more personalized and adaptive e-learning systems. The incorporation of student characteristics, especially learning style and knowledge level, may be used to enhance learning. Future Research: The experiment might be duplicated with a focus on longer-term learning gains by including more subjects and more learning resources. Also, the study might be expanded to application domains other than computer security. Moreover, other variables such as student satisfaction, motivation, and affective state might be explored to further the understanding of the effect of adaptivity on learning gains.

New Cryptography and Computer Security Teaching Methods Using Network Technologies

According to a detailed analysis of modern global trends, the approaches to teaching cryptography and computer security are becoming more practical and actively draw on information from global networks and code-design methods. Security system architects must have deep expertise in programming methods, especially cryptographic algorithm programming procedures, and rapidly navigate in vast amounts of information in global networks using system-analysis methods.

DMS2015short-2: Advanced learning technologies for eLearning in the enterprise: Design of an Educational Adventure Game to teach computer security

Emerging requirements for learning in the enterprise are developing critical reasoning and keeping the learner engaged. Advanced didactical material that exploits gameful design should increase engagement by creating a product that has the spirit, and not just the mechanics, of a good game. This article presents game design guidelines for the development of an Educational Adventure Game and how they have been applied during the development of SIRET Security Game, a game that teaches workers the importance of following computer security policies.

Can We Sniff Wi-Fi?: Implications of Joffe v. Google

On 27 December 2013, the US Court of Appeals for the Ninth Circuit issued an opinion that intercepting data from unencrypted wireless local area networks--Wi-Fi sniffing--can violate the US Wiretap Act. The case centers on a Wi-Fi sniffer that was present in Google Street View vehicles that roamed the US between 2008 and 2010 and that were permanently recording every unencrypted Wi-Fi frame that they intercepted. Although the Wiretap Act has a broad exemption for intercepting radio communications that are generally accessible to the public, the Court ruled that Wi-Fi is not a radio communication. The ruling, if it stands, will significantly impact computer security education, in which Wi-Fi sniffing is a common student exercise; security practitioners, who frequently sniff for security assessments; and computer security research, which has traditionally used collection in the wild as a way of finding vulnerabilities.

Incorporating hacking projects in computer and information security education: an empirical study

Incorporating hacking projects in information security education is controversial. However, several studies discussed the benefits of including offensive exercises (e.g., hacking) in information security courses. In this paper, we present our experiment in incorporating hacking projects in the laboratory exercises for an undergraduate-level Computer and Information Security (CIS) course at King Abdulaziz University (KAU), Saudi Arabia. We conducted a survey to measure the effectiveness of incorporating hacking projects from the students' perspective. We also questioned the ethical aspects of these projects. The results strongly suggest that hacking projects have helped the students better understanding computer and information security principles. Furthermore, the majority of the students stated that they do not intend to misuse the learned skills, mainly for religious and ethical reasons. We also present the precautions that we took to avoid legal or ethical consequences that may be connected with these activities.

Using webcasts to teach computer security

Computer security classes can be enhanced by listening to or viewing webcasts. Through webcasts students can learn about current security trends from experts. This paper discusses of variety of sources of webcasts and how they can be used to spice up a computer security class.

V-Lab

In computer and network security education, hands-on laboratories are essential to help students understand the course content. However, hands-on laboratories are difficult to implement due to the complicated setup and location restrictions of a physical laboratory, which limits their use in online education. Using a remotely accessible, physically unconstrained virtual laboratory is a natural solution. Existing laboratory solutions are usually expensive to build, configure and maintain, while still lacking reusability, flexibility, and scalability. The authors propose a remote, virtual laboratory that provides cloud resources to both desktop and mobile users, called V-Lab. By using a flexible and reconfigurable design, V-Lab greatly reduces the effort needed to establish and maintain a physical laboratory, while providing a secure, reliable, and physically unrestricted environment that allows students to use resources based on their own schedule. Preliminary results show that students report that V- Lab system is intuitive, reliable, and helps them solve real-world problems.

SEED: Hands-On Lab Exercises for Computer Security Education

This paper presents the development of a set of hands-on exercises(labs) that covered a spectrum of security topics and could be shared with other instructors. The author developed SEED labs covering many security topics: vulnerabilities, attacks, software security, system security, network security, Web security, access control, authentication, cryptography, and so on. Most SEED labs have gone through multiple development trial cycles in university courses. Many universities have requested the instructor's manual and adopted SEED labs for their courses. Most SEED labs use Ubuntu Linux. A few labs require significant effort for kernel-level coding; for them, the author chose Minix, an instructional OS. SEED labs don't require a dedi cated physical laboratory. The author created a prebuilt VM image of Ubuntu and installed the necessary software. Various lab environment setups were tried, including using students' PCs, a general computing lab, and a cloud-computing infrastructure. And found that for convenience, students prefer to use their own computers.

Demythifying Cybersecurity

A large part of computer security education is tackling myths that support much of the practice in the field. By examining these myths and the underlying truths or heuristics they reflect, we learn three things. First, students and practitioners learn to separate what is empirically and theoretically supported from what is supported solely by untested anecdotes or handeddown "best practices." Second, a key part of education is the human dimension of convincing others that stories that sound right aren't proven and might in fact be wrong. They aren't necessarily wrong-but this possibility must be considered. Finally, we can consider myths from the perspective of teaching stories, because many evolve from activities that at one time were true or that have some accurate elements.

Visualization Tools for Teaching Computer Security

Using animated visualization tools has been an important teaching approach in computer science education. We have developed three visualization and animation tools that demonstrate various information security concepts and actively engage learners. The information security concepts illustrated include: packet sniffer and related computer network concepts, the Kerberos authentication architecture, and wireless network attacks. These tools are implemented using Macromedia Flash MX Professional Edition. The animations can run from a Web page as Flash Applets or as standalone applications. These visualization tools are intended to be used in undergraduate level computer network and security courses. They can be used as classroom instructor demos, student exercises, or Web-based student learning resources. These tools have been used in various computer network and information security courses at North Carolina A&T State University, and have received positive feedback from the students.

Information Assurance Education: A Work In Progress

The recognition that we need improved computer security education has increased over the past several years. Recent cyberattacks in Georgia and Estonia exemplify the new threats faced by economies that rely on the Internet. Thus, more people see the need to protect cyberspace-which translates into improving computer security in all aspects of computer use-as crucial for everyone, not merely for those who work with technology. In this column, we reflect on emerging opportunities and challenges in instruction as well as the need for increasing the partnerships among industry, government, and academia to foster mutual understanding of challenges and joint participation in solutions.

Placing computer security at the heart of learning

In this paper we present the approach adopted at the UK’s Open University for teaching computer security to large numbers of students at a distance through supported open learning. We discuss how the production of learning materials at the university has had to change to reflect the ever-increasing rate of technological, legislative and social change within the computing discipline, and how the university has had to rethink the role of the academic in th ec ourse development process. We argue that computer security is best taught starting at th ee arliest level of undergraduate teaching and continuing through in-depth postgraduate study. We discuss our approach which combines the traditional technical aspects of security with discussions on the professional and ethical issues surrounding security and privacy. This approach presents computer security and privacy in the light of relevant legislative and regulatory regimes, thus the students have a firm grounding in the relevant national and international laws. We discuss the importance of international standards for information security risk assessment and management and as well as the relevance of forensic computing to a computer security curriculum. We conclude with an examination of our course development methodology and argue for a practitioner-led approach to teaching.

SEED

The security and assurance of our computing infrastructure has become a national priority. To address this priority, higher education has gradually incorporated the principles of computer and information security into the mainstream undergraduate and graduate computer science curricula. To achieve effective education, learning security principles must be grounded in experience. This calls for effective laboratory exercises (or course projects). Although a number of laboratories have been designed for security education, they only cover a small portion of the fundamental security principles. Moreover, their underlying lab environments are different, making integration of these laboratories infeasible for a semester-long course. Currently, security laboratories that can be widely adopted are still lacking, and they are in great demand in security education. We have developed a novel laboratory environment (referred to as SEED). The SEED environment consists of Minix, an instructional operating system (OS), and Linux, a production OS; it takes advantage of the simplicity of Minix and the completeness of Linux, and provides a unified platform to support a rich set of laboratories for computer security education. Based on the SEED environment, we have developed a list of laboratories that cover a wide spectrum of security principles. These labs provide opportunities for students to develop essential skills for secure computing practice. We have been using these labs in our courses during the last five years. This article presents our SEED environment, laboratories, and evaluation results.

Computer Security Practices and Perceptions of the Next Generation of Corporate Computer Use

The purpose of this article is to present the results of an empirical study of the computer security practices and perceptions of the next generation of corporate computer users, undergraduate university students. The authors surveyed undergraduate university students who represented 42 different majors. The findings relate to the students’ usage of antivirus programs, firewalls, password security, and security patches. Student perceptions of computer security and its importance are also reported. Research in this area is important for two reasons. First, potential employers may find the results useful in assessing their vulnerability to unsafe practices from entry level employees. Secondly, research in this area can give those responsible for providing computer security education a better understanding of students’ computer security training needs.

Educating Students to Create Trustworthy Systems

Computer science's long-standing tradition of computer security education has focused primarily on designing secure and reliable systems that can ensure information confidentiality, integrity, and availability. This tradition is geared toward preparing students for typical paradigms, such as writing secure code, providing authentication and access control, and developing policies to limit exposure to vulnerabilities and protect users' rights. Faculty and industry must find novel, cross-disciplinary approaches to educating security professionals to fully address this array of issues. In this article, we analyze barriers to effective security education and offer suggestions for improving cooperation among computer science, business management, information systems. and other technology departments.