cart

Members

Join Login

Membership and collaboration facilitated by Member 365.

Members

Join Login

Membership and collaboration facilitated by Member 365.

23rd Colloquium

June 10th to 12th, 2019

Las Vegas, Nevada

23rd Colloquium - Paper Proceedings

Papers from the 23rd Colloquium have been published "as is" and are available below. We are currently evaluating research papers to be considered for publication in our bi-annual Journal of The Colloquium for Information System Security Education. For more information, or to communicate with our editorial team, please email journal@thecolloquium.org.

A Case for Comprehensive, Explicit Ethics Training in Cybersecurity

Denise M. Kinsey

Pages: 4

A Case for Comprehensive, Explicit Ethics Training in Cybersecurity

Denise M. Kinsey

The ramifications of cybersecurity decisions can range from nominal to life and death. When preparing cybersecurity professionals to make these decisions, educators should ensure that students are prepared with the knowledge and understanding of how to assess the situation and react in an appropriate manner. To achieve that level of competence cybersecurity ethics should be taught in a manner that empowers and prepares students to address those issues. By creating authentic experiences and exercises the student can be immersed in the content and have those memories to reference when a new situation occurs. This paper details the need for interactive cybersecurity education and details the results of an experiment to determine the likelihood of students to behave ethically if there was little chance of getting caught.

A Laboratory for Hands-on Cyber Threat Hunting Education

Jinpeng Wei; Bei-Tseng “Bill” Chu; Deanne Cranford-Wesley; James Brown

Pages: 20

A Laboratory for Hands-on Cyber Threat Hunting Education

Jinpeng Wei; Bei-Tseng “Bill” Chu; Deanne Cranford-Wesley; James Brown

Cyber threat hunting has emerged as a critical part of cyber security practice. However, there is a severe shortage of cybersecurity professionals with advanced analysis skills for cyber threat hunting. Sponsored by NSA, the University of North Carolina at Charlotte (UNC Charlotte) and Forsyth Technical Community College (Forsyth Tech) have been developing freely-available, hands-on teaching materials for cyber threat hunting suitable for use in two-year community college curriculum, 4-year universities curriculum, as well as for collegiate threat hunting competitions. Our hands-on labs focus on exercising a set of essential technical skills (called the threat hunting skill set) in an enterprise environment and they are modeled after real world scenarios. Our lab environment contains real threats (e.g., malware) against real software (e.g., Operating Systems and applications), and real security datasets. These labs are designed to help a student learn how to detect active and dormant malware, analyze its activities, and assess its impact. These labs also teach a student how to search and probe for anomalies in a variety of datasets using multiple analytical skills, such as statistical analysis. In this paper, we present the design and implementation of our hands-on labs.

A Model for Security Evaluation of Digital Libraries: A Case Study on a Cybersecurity Curriculum Library

Nnatubemugo “Ugo” Ngwum; Sagar Raina; Sabina Aguon; Siddharth Kaza

Pages: 12

A Model for Security Evaluation of Digital Libraries: A Case Study on a Cybersecurity Curriculum Library

Nnatubemugo “Ugo” Ngwum; Sagar Raina; Sabina Aguon; Siddharth Kaza

The use of digital libraries (DLs) is increasing. To attract users and sustain digital libraries, security of these systems is critical. Through extensive review of literature, standards and other security technical reports, we propose a model for security evaluation of digital libraries and test the effectiveness of the model using the CLARK cybersecurity curriculum digital library (www.clark.center) at Towson University. We identify five core security criteria that are broken down into several security requirements that a DL should fulfil to achieve security. Results from the evaluation, which include static code analysis and expert review of CLARK’s security mechanisms, indicate the proposed model is significantly effective in evaluating the security requirements of digital libraries.

A New Approach to Understand Cybersecurity Workforce Career Path and Its Knowledge, Skills, and Abilities

Dan J. Kim

Pages: 17

A New Approach to Understand Cybersecurity Workforce Career Path and Its Knowledge, Skills, and Abilities

Dan J. Kim

As we are increasingly living in “digital” world, threats to cybersecurity, such as identity theft, are also on the increase, the need for qualified cyber security professionals is ever increasing; There is currently a shortage of qualified cybersecurity professionals. Outlining the relationships and associative qualifications among cybersecurity job titles, would clarify the progression of knowledge, skills and abilities according to work role classification. This study analyzes the variance in job classifications and job descriptions provided in existing cybersecurity workforce resumes to model career progression. We first analyze the schema regarding industry job titles and work roles utilized by current industry professionals. Then, we propose a model of cybersecurity career pathways based on empirical job transitions and job description data. The proposed model will benefit both cybersecurity professionals to advance their careers and educational organizations to supply qualified cybersecurity professionals by offering the most suitable curriculum.

A Study on Cyber Attacks and Vulnerabilities in Mobile Payment Applications

Oriel Rivers; Yen-Hung (Frank) Hu; Mary Ann Hoppa

Pages: 24

A Study on Cyber Attacks and Vulnerabilities in Mobile Payment Applications

Oriel Rivers; Yen-Hung (Frank) Hu; Mary Ann Hoppa

The end-to-end mobile purchase process depends on the decisions and actions of many stakeholders, including consumers, mobile application developers, mobile payment service providers, merchants, financial institutions like banks and credit card companies, and their respective data centers. This paper presents a detailed look at mobile payments as a sequence of transactions to better understand what is required to authenticate, authorize, verify and process them, and where security vulnerabilities lie. This analysis was accomplished by conducting in-depth research on three popular use cases – Apple Pay, Google Pay, and Samsung Pay – analyzing their respective potentials for being compromised, and suggesting opportunities where higher levels of security can be attained. While many mechanisms exist that can contribute to safeguarding mobile transactions, this analysis shows many ways known vulnerabilities and attacks still can be leveraged to exploit users’ data within popular mobile payment solutions. Approaches for improving the security of mobile payment transactions are included as way-ahead recommendations.

A Study on Vulnerabilities and Threats to SCADA Devices

Dawn Silverman; Yen-Hung (Frank) Hu; Mary Ann Hoppa

Pages: 21

A Study on Vulnerabilities and Threats to SCADA Devices

Dawn Silverman; Yen-Hung (Frank) Hu; Mary Ann Hoppa

SCADA devices have increasingly become targets of malicious actors, alerting industries, governments and even private citizens to the need for more effective security measures, particularly for critical infrastructure and industrial control systems. To address concerns on this issue, a thorough survey and investigation was conducted on cyber-attacks targeting SCADA systems to propose solutions and recommendations for mitigating such attacks. This research first studied some historical perspectives on SCADA and associated risks, including examples of typical attacks. After summarizing known SCADA vulnerabilities and some attempts to harden these systems, a deeper-dive was taken on a breach of the Schneider Triconex Tricon 3008 safety system as an instructive use case. Some general recommendations were made for methodically securing SCADA networks. The long-term objective of this research is to better secure the future of SCADA and, by implication, the critical infrastructures that depend on this technology, through more focused cybersecurity vulnerability assessment and mitigation.

A Study on Vulnerabilities and Threats to Wearable Devices

Felton Blow; Yen-Hung (Frank) Hu; Mary Ann Hoppa

Pages: 15

A Study on Vulnerabilities and Threats to Wearable Devices

Felton Blow; Yen-Hung (Frank) Hu; Mary Ann Hoppa

Connected, wearable devices are increasingly being adopted by individuals who want to monitor personal data such as location and vital biometrics, and to receive performance feedbacks and product updates in real time. The quality of life gains these gadgets support for users, and the opportunities they enable for vendors to maintain ongoing relationships with consumers, may backfire if security and privacy are not addressed appropriately. This research explored cybersecurity vulnerabilities, threats, and risks related to wearable devices using the Fitbit smartwatch as a popular example. Analysis focused on the sensors that are integrated into such devices. Understanding how these components work exposed ways they can be exploited, which in turn suggested ways to mitigate potential cyber-attacks on wearable devices. These findings provide a foundation for developing awareness and education, and recommending best practices for wearable devices to balance their functionality and convenience with personal privacy and organizational cybersecurity concerns.

Addressing the Cybersecurity Workforce Development Problem - Augusta University's Contribution

Joanne Sexton; Karen Ribble; Franklin Perrin

Pages: 14

Addressing the Cybersecurity Workforce Development Problem - Augusta University's Contribution

Joanne Sexton; Karen Ribble; Franklin Perrin

When the Army Cyber Command announced that it was relocating to Fort Gordon, GA, a community based taskforce was created called The Alliance for Cybersecurity Education (ACE). ACE was founded with the following mission: 1) to facilitate the creation of a community-based cybersecurity niche to raise the effective value of 6-12 educational system and its integration into post-secondary education; and, 2) seek to increase students’ capabilities, generate an employable cybersecurity workforce. Augusta University, a National Center of Academic Excellence in Cyber Defense, (CAE-CD) and also a leading organization in ACE, engaged a consortium of local public school systems, chambers of commerce, and Fort Gordon military community to develop a K-12 Career Pathway in Cybersecurity with the ultimate goal of state board approval by the GA Department of Education (GA DOE). The actual cybersecurity curriculum was written by the Cyber College, Cyber Center of Excellence, Fort Gordon. This paper presents a model for universities and public schools to collaborate on building a cybersecurity pathway in high schools by engaging local community support, using shared technology resources for students and professional development for high school teachers.

ADLES v2.0: Managing Rapid Reconfiguration of Complex Virtual Machine Environments

Jason Allen; Dr. Daniel Conte de Leon; Dr. Michael Haney

Pages: 11

ADLES v2.0: Managing Rapid Reconfiguration of Complex Virtual Machine Environments

Jason Allen; Dr. Daniel Conte de Leon; Dr. Michael Haney

Cybersecurity education environments and other computer laboratories, such as those that support a DevOps effort, rely on virtualization of many computer systems to meet their complexity and scalability requirements. Often, these environments are set up once in a stable configuration and left relatively unchanged during operation. Given the need to rapidly reconfigure and redeploy environments to suit varying scenarios necessary for cybersecurity research and education, time required for redeployment must be kept to a minimum (e.g. the time allowed between class changeovers on a given day). To support this effort, we have developed ADLES: the Automated Deployment of Lab Environment Systems. Initial release of this tool provided for the management of VMware vSphere in a single hypervisor environment. The current improvements discussed in this paper include management of VirtualBox systems and deployment onto multiple workstations across a network. This improved iteration of ADLES offers greater flexibility to meet the needs of managing complex private cloud environments for cybersecurity research and education, as well as potentially other users with similar needs and requirements for rapid reconfiguration.

Building the Cybersecurity Pipeline: A Community Based Lifecycle Approach

Lonnie G. Decker; Deanne Wesley

Pages: 19

Building the Cybersecurity Pipeline: A Community Based Lifecycle Approach

Lonnie G. Decker; Deanne Wesley

The need for cybersecurity workers is clear.With a documented current shortage of cybersecurity workers in the U.S. identified as over 300,000 openings, the need to attract, and retain more future cybersecurity workers could not be more clear.Many efforts have been created to address this need and have had clear positive results.These include the use of summer camps & competitions to increase interest in the field, reaching out to underrepresented populations to help fill the need, and providing scholarships and using shared curriculum to help students through their educational pathway. This paper proposes the implementation of a Community Based Life Cycle (CBLC) approach to help address this need.With the development of a Cyber Education Task Force (CETF), the ability to use a systems development approach to identify and align the efforts that already have been developed to help retain students’ interest in cybersecurity as a career.Through the use of professional and peer mentoring in a Cascade Advising approach, the professional mentors (and members of the CETF) would identify communities (summer camps, competitions, etc.), where peer mentors can be effective in helping newer and future students be successful.

Convergence and Proliferation of Technologies: Cybersecurity, Privacy, and Risk Management

A.Yarali; R. Joyce; D. Albeloshi; J. Edwards; B. Dixon

Pages: 16

Convergence and Proliferation of Technologies: Cybersecurity, Privacy, and Risk Management

A.Yarali; R. Joyce; D. Albeloshi; J. Edwards; B. Dixon

The world nearly completes the transition from being analog to the digital age and digital technology is revolutionizing the way society operates and empowers individuals to participate in social events. The future of business tech will continue to experience exponential growth as more organizations will continue to implement the latest technological advancements to run various functions and processes and businesses are transforming from doing digital to being digital by the wholesale restructuring of their strategic processes. Even as the future of business technology continues to get brighter, there is a need to reconsider cybersecurity, privacy, and risk management issues. As technology continues to advance, the risks become more, and thus, security becomes a significant aspect that needs to be addressed. In the last few years, new laws have been developed to regulate how service providers collect, use, retain, disclose, and dispose of user information. The number of cyber-attacks and data breaches have been rising at an alarming rate; it is essential for the organization to take necessary precautions to protect their data. In this paper, transformation and advancement to a pervasive and converged digital infrastructure of AI, IoT, and big data with their threats and security at all levels of entry points, customer demand, surface attack, and landscape are discussed.

Creating Shareable Cybersecurity Laboratory Exercises

Wm. Arthur Conklin

Pages: 9

Creating Shareable Cybersecurity Laboratory Exercises

Wm. Arthur Conklin

Laboratory exercises are one of the foundational elements behind a hands-on, active learning curriculum. Creating these exercises in a manner that can be shared between institutions necessitates specific elements be addressed in the creation of the laboratory exercise. This paper examines these elements and how they support a shareable laboratory experience that can be easily replicated between programs.

Cyber criminology, Criminology and Cybercrime: Towards an Academic Discipline

Gregory Laidlaw; Charles E. Wilson

Pages: 19

Cyber criminology, Criminology and Cybercrime: Towards an Academic Discipline

Gregory Laidlaw; Charles E. Wilson

Cybercrime is a growing global phenomenon that has created a significant paradigm shift in critical areas of the personal life of citizens, and in both the public and private sectors. The negative impact of cybercrime is felt in many diverse areas, such as politics, economics, national security, public safety, and in many critical societal activities related to quality of life. Today, essential online functions are constantly under attack by a growing cadre of sophisticated cybercriminals, organized crime organizations, and nation-state actors. The purpose of this paper is to synthesize current research literature on cybercrime to highlight the scope of the problem; and to suggest a notional concept of criminological theories that can be applied to enhance cybercrime investigation and enforcement efforts. Additionally, the paper proposes the establishment of an academic minor “Cyber criminology” based on an interdisciplinary approach.

Cybersecurity Behavior: Current Trends in the Use of Protective Measures and Reasons Why They Aren’t Used

Marc Dupuis

Pages: 21

Cybersecurity Behavior: Current Trends in the Use of Protective Measures and Reasons Why They Aren’t Used

Marc Dupuis

Cybersecurity behavior changes over time, as do the recommendations for how one may best protect themselves from cybersecurity threats. This paper examines current trends in what protective measures people take, such as using a password manager, virtual private network (VPN), or anti-malware software. The reasons why people employ these protective measures is explored, including why some choose not to. The evidence indicates that there is an important place for security education, training, and awareness (SETA) programs to help those that do not use such measures.

Details of a Malicious Code Analysis Course

Ann Sobel; Michael Gentile

Pages: 10

Details of a Malicious Code Analysis Course

Ann Sobel; Michael Gentile

Miami University has committed to the goal of increasing cybersecurity education. To this end, the department of Computer Science and Software Engineering has approved the intent of offering a cybersecurity minor which has a topic composition meeting the accreditation criteria of a National Security Agency CAE cyber operations fundamentals focus area. A trial offering of a new course satisfying the mandatory topic of reverse engineering is outlined here.The main component of the learning objectives of this new course is the hands-on experience of disassembly tools to identify malicious code through laboratory exercises.Future work includes the assessment of this laboratory experience both in the tools used and their effectiveness when performing static analysis of assembly-based code to identify potential nefarious acts.

Developing a Cybersecurity Curriculum and Assessment using the New ABET Student Outcomes

Judson Dressler; Bobby Birrer; Lucille McMinn; Matthew Sievers; David Caswell

Pages: 10

Developing a Cybersecurity Curriculum and Assessment using the New ABET Student Outcomes

Judson Dressler; Bobby Birrer; Lucille McMinn; Matthew Sievers; David Caswell

With the recent updates to ABET's Criteria for Accrediting Computing Programs as well as the addition of the new cybersecurity program, opportunities for innovation and efficiencies have emerged. As we continue to build-out our Cyber Science program, exploring these new opportunities resulted in a streamlined management and assessment process while providing great opportunity to create and maintain a robust and relevant program. This paper documents the recent ABET changes and describes how one of the first ABET accredited cybersecurity programs is meeting these new standards.

Development of Cybersecurity Lab Exercises for Mobile Health

Hongmei Chi; Meysam Ghaffari; Ashok Srinivasan; Eleason Williams

Pages: 10

Development of Cybersecurity Lab Exercises for Mobile Health

Hongmei Chi; Meysam Ghaffari; Ashok Srinivasan; Eleason Williams

There is an emerging class of public health applications where non-health data from mobile apps, such as social media data, are used in subsequent models that identify threats to public health. On one hand, these models require accurate data, which would have immense impact on public health. On the other hand, results from these models could compromise privacy of an individual’s health status even without directly using health data. In addition, privacy could also be affected if systems hosting these models are compromised through security breaches. Students ought to be trained in evaluating the effectiveness of different protocols in ensuring privacy while providing useful data to the models. There is a lacuna in current cybersecurity education in training students in the context of both the above types mobile health applications. The objective of this paper is to develop educational material to augment current cybersecurity courses for undergraduate and graduate students. We will develop material to teach about fundamental issues related to security and privacy in mobile health applications, and produce a cloud-based hands-on lab that lets students explore consequences of different solution strategies. Lab exercises will provide students with insight into development of practical solutions based on sound theoretical foundations.

Educating the Masses: Cybersecurity for Everyone

D’Nita Andres Graham

Pages: 13

Educating the Masses: Cybersecurity for Everyone

D’Nita Andres Graham

Cybersecurity is no longer just the concern of Information Technology (IT) teams. Emerging technologies like artificial intelligence and machine learning are changing the game for cybersecurity. To remain relevant and promote pedagogical framework, K-12 and institutions of higher education should continue to have conversations about cybersecurity education. As part of the paradigm shift cybersecurity education should be a priority. It is essential to equip administration, faculty, staff, and students with the advantages and disadvantages to ensure end users are not introducing a threat. Having a “cyber aware” student means they go home and into the 21st Century workforce exercising those same best practices. As the National Cybersecurity Alliance points out: “This is Shared Responsibility. We each have to work together to keep ourselves, families, schools, communities and our nation safe.” The purpose of this paper is to communicate on the subject of cybersecurity – across all sectors of government; businesses, academic institutions, and individuals.

Education Pathways to Reduce the Gap in the Cyber Security Workforce

Brandon R. Brown; Tobi West; Ronald E. Pike

Pages: 16

Education Pathways to Reduce the Gap in the Cyber Security Workforce

Brandon R. Brown; Tobi West; Ronald E. Pike

Security Operations Centers are the first line of network defense for many organizations and therefore require highly skilled personnel. However, with the lack of skilled workers, many positions go unfilled due to both the lack of skilled workers and the high salaries these workers can command. This paper reports on ways to bridge this gap through leveraging the Centers of Academic Excellence for Cyber Defense Education (CAE-CDE). We will also explore a typical curriculum at one of these institutions and explain opportunities that can be gained through the effective use of talent coming from CAE-CDE institutions.

Employer Perceptions of Recent Cybersecurity Graduates

Nelbert St. Clair; John Girard

Pages: 25

Employer Perceptions of Recent Cybersecurity Graduates

Nelbert St. Clair; John Girard

This pioneering research project examines the expectations of cybersecurity professionals in terms of contentment with recent graduates. In particular, the project sought to determine the professionals' satisfaction with recent hires of undergraduate graduates. Overall, 73% of the participants indicated satisfaction with recent cybersecurity graduates. In addition, 67% of these professionals believed that recent graduates had a satisfactory level of competency.

Enhancing Mobile and Ubiquitous Learning of Cyber Security Concepts

Leonnel Kwedeu; Damen Ngatchu Nyinkeu; Gilemond Nchiwo; Carine Ebude Awasume

Pages: 10

Enhancing Mobile and Ubiquitous Learning of Cyber Security Concepts

Leonnel Kwedeu; Damen Ngatchu Nyinkeu; Gilemond Nchiwo; Carine Ebude Awasume

Amidst precarious socio-political circumstances, information security is paramount, since saying the wrong thing in the wrong context can turn one into a political enemy. In addition, where such circumstances affect educational institutions, mobile, ubiquitous teaching and learning becomes a safe heaven for Universities. This paper explores how the learning of cyber security concepts have been enhanced through mobile and ubiquitous learning methods. By collecting qualitative data from cyber security majors in an African University, the study found that students’ appreciation of concepts such as operationalization of the cyber security triad, understanding and identifying of security threats, Hardening techniques as well as security awareness was greatly influenced by their learning context. However, it was perceived that there is little or no connection between their cybersecurity knowledge and the experience they faced. The paper concludes by recommending ways in which ubiquitous learning could be better leveraged for the African context.

GenCyberCoin: Sparking Cybersecurity Interest with a Gamified Platform for Cybersecurity Summer Camps and Classrooms

Vitaly Ford; Ambareen Siraj

Pages: 12

GenCyberCoin: Sparking Cybersecurity Interest with a Gamified Platform for Cybersecurity Summer Camps and Classrooms

Vitaly Ford; Ambareen Siraj

Teaching cybersecurity requires dedicating a substantial amount of time and effort to combine both practical and theoretical notions into a coherent and clear chain of thoughts. Educators have been exploring various gamification techniques to spark interest among students and engage them with interactive activities leading to a cybersecurity career. In this paper, we present a GenCyberCoin open-source web platform that can be used as a complementary module to the existing teaching material in cybersecurity summer camps and classrooms. GenCyberCoin aims to facilitate the development of students’ interest in cybersecurity by providing students with opportunities to earn and spend digital currency, practice bug hunting, and get rewarded for helping peers and completing tasks. This platform introduces students to real-world concepts such as the blockchain, digital currency markets, banks, cybersecurity principles, open source intelligence gathering, passwords, bug bounty, and social norms and values.

Guarding Sensitive Sensor Data against Malicious Mobile Applications

Cynthia Claiborne; Ram Dantu; Cathy Ncube

Pages: 13

Guarding Sensitive Sensor Data against Malicious Mobile Applications

Cynthia Claiborne; Ram Dantu; Cathy Ncube

With increasing usage of sensor data for medical purposes, the ability to secure sensitive features in mobile sensor data from adversarial applications is a continuous challenge. This paper introduces a random anonymization algorithm, SparCTym, as a method for anonymizing sensitive features in walking accelerometer data while maintaining the utility of the data. SparCTym was implemented in the Android framework of a Nexsus S phone and tested with activity recognition applications.

Hands-on Labs for Secure Programming on Modern Trusted Platforms

Yuzhe Tang; Wenliang Du

Pages: 19

Hands-on Labs for Secure Programming on Modern Trusted Platforms

Yuzhe Tang; Wenliang Du

With the increasing awareness of cyber-security issues, cyber-security workforce becomes an urgent societal need. Of particular importance is the development skills of building secure applications. To meet the educational demand, we propose to develop hands-on labs and education tools for “secure development on modern trusted platforms”. This work focuses on two emerging trusted platforms, that is, trusted execution environments (e.g., recently released Intel SGX CPU) for secure application hosting on a third-party cloud (e.g., Amazon), and the Blockchain technology that underlies the Bitcoin and other cryptocurrencies by trustworthy data recording. We develop two sets of lab modules, respectively for Intel SGX and Blockchain. The SGX labs address the necessary skills and techniques on software partitioning, SGX memory protection, side-channel security and software attestation. For Blockchain, we build an education tool enabling the integration of Blockchain in students’ course-taking experience. We also develop two Blockchain labs on transaction programming and logging applications. Through evaluation, it is shown that the project helps improve students’ interest in SGX and Blockchain, and helps them develop secure applications on these platforms.

Healthcare in the Balance: A Consequence of Cybersecurity

Susan Helser

Pages: 12

Healthcare in the Balance: A Consequence of Cybersecurity

Susan Helser

The mandate for cybersecurity crosses disciplines. The deficit in the number of cybersecurity professionals required to fill current and future positions represents a growing challenge. Cybersecurity readiness presents significant ever-changing issues with possible long-term or perhaps life-threatening consequences. Cybersecurity experts who possess critical knowledge in another field such as healthcare where a combined or blended understanding of key information is integral to the industry are in short supply. In healthcare as is the case in a host of other sectors not only is it necessary that systems and data are protected, but the business must be compliant with existing law as well. It is imperative that action be taken to address the problem in order not to limit access to healthcare. The focus of this research is to study the serious shortage of cybersecurity professionals in the field of healthcare, the impact that this issue has on the availability of healthcare, and to suggest a solution that could provide immediate relief.

Improving the Pipeline

Sandra Gorka; Alicia McNett; Jacob R. Miller; Bradley M. Webb

Pages: 11

Improving the Pipeline

Sandra Gorka; Alicia McNett; Jacob R. Miller; Bradley M. Webb

There is currently a shortage of cybersecurity professionals worldwide. This paper presents an after school program for high school students to explore cybersecurity topics and careers. The paper discusses the content of the course as well as the results that have been seen to date. A link to an online repository of program materials will be shared with the audience. This work effort is the result of the NSF funded grant Improving the Pipeline: After-School Model for Preparing Information Assurance and Cyber Defense Professionals (Grant No. 1623525).

Introducing Secure Design by Scripting in an Undergraduate Microcontroller Based Design Course

Kalyan Mondal; Angela Elias-Medina

Pages: 12

Introducing Secure Design by Scripting in an Undergraduate Microcontroller Based Design Course

Kalyan Mondal; Angela Elias-Medina

This paper discusses a systematic approach to revising a second undergraduate course on microprocessor system design to improve student learning outcomes by introducing scripting-based design with a security mindset. The current course is based upon using the Dragon 12-Plus development system which requires using compiled C code and does not offer any on-board security features. The updated course has the intended outcomes of gaining design and technical skills on multiple microcontroller-based design platforms and introduce “security mind-set” for networked systems. A Project Based Learning (PBL) approach is also introduced, and the focus of the course is on hands-on activities where the students work on multiple design projects using C and MicroPython. The course hardware platform of Dragon 12-Plus is augmented with a small form factor pyboard, which is used to acquire sensor data and transmit securely for simple data analytics. Three new laboratories, including one on data security usingMicroPython are introduced. Necessary changes to undergraduate engineering programming course sequence are outlined. Additionally, mapping of these new labs to CAE-CD KUs and the NICE Framework Specialty Areas is included.

Modeling and Automating the Cyber Reverse Engineering Cognitive Process

Patrick P. Dudenhofer

Pages: 18

Modeling and Automating the Cyber Reverse Engineering Cognitive Process

Patrick P. Dudenhofer

Software reverse engineers (SREs) face a significant cognitive load when analyzing unknown binary artifacts for security vulnerabilities or malicious intent. The ability to automate or augment these complex reverse engineering tasks would provide a substantial benefit both for the training and productivity of binary analysis work. Such computational support requires a formal model of the reverse engineer's knowledge and operations but little research effort has been expended toward understanding the cognitive aspects of the software reverse engineering process. SREs often begin the reverse engineering process by exploring the binary executable's artifacts to discover information cues that correspond with their own abstract knowledge of the cyber security domain. Upon discovering an interesting information cue, the SREs integrate that new data into their working hypothesis of the program's behavior. As additional information cues are uncovered, these cues shape and elaborate upon SREs’ current hypothesis of the software's purpose and also serve as indicators for additional exploration vectors. This paper proposes a cognitive model detailing the mental constructs and processes required for successfully completing a software reverse engineering task. The cognitive model described will facilitate accelerated development of automation and interface aids for complex binary analysis tasks.

Network Air Locks, not Air Gaps, to Preserve LAN Security

Michael McGregor; Zach Lontz; Dr. Daniel Conte de Leon; Dr. Michael Haney

Pages: 16

Network Air Locks, not Air Gaps, to Preserve LAN Security

Michael McGregor; Zach Lontz; Dr. Daniel Conte de Leon; Dr. Michael Haney

In cybersecurity research and education, as in many other domains, there is often a need to work with sensitive information or dangerous code in order to study and understand it. It is often proposed that networks with very high security requirements be “air gapped,” which we understand to mean they are permanently disconnected from any other networks, especially the Internet. However, secure air gapped networks are a myth. If they remain air gapped, they do not remain secure as new vulnerabilities are continuously discovered. If they are to maintain an appropriate level of security, they will not remain air-gapped. Inevitably, temporary workarounds, unknown or undocumented network connections, modems, mobile devices such as vendors’ or support personnel’s laptops and Ethernet cables, or the ubiquitous USB storage devices (i.e. the “sneakernet”) will eventually be used to transfer data and code onto or off of the network that is intended to be isolated. We therefor propose a management method and system of tools and controls that maintains an isolated-by-default network with controlled and monitored temporary connections to an external network. This approach is similar to an air lock system. This system incorporates multiple network layers of isolation, control, and monitoring, including physical layer controls. Such an approach is useful for our isolated cybersecurity research network and would be applicable to many types of high security local area networks.

Period Finding on a Quantum Computer using Shor’s Algorithm

Samuel Marcillo-Gomez; Dr. Alberto La Cava

Pages: 10

Period Finding on a Quantum Computer using Shor’s Algorithm

Samuel Marcillo-Gomez; Dr. Alberto La Cava

In recent years, there have been numerous developments in quantum computation. These developments have brought into question, how quantum computers could affect security have risen. For instance, Shor’s algorithm is believed to be able to break certain encryptions faster on a perfect quantum computer faster than on, what is known as, classical computers. In a few years or decades, there could be significant developments made that allow for quantum computers to perform Shor’s Algorithm. As quantum computers exist now, the implementation of the algorithm is known to be difficult as the computes are very basic. Attempts to create quantum circuits that can compute Shor’s Algorithms aid in the understanding of the algorithm.

pico-Boo!: How to avoid scaring students away in a CTF competition

Kentrell Owens; Alexander Fulton; Luke Jones; Martin Carlisle

Pages: 16

pico-Boo!: How to avoid scaring students away in a CTF competition

Kentrell Owens; Alexander Fulton; Luke Jones; Martin Carlisle

The lack of computer security experts poses a challenge for the private sector and national security. To encourage middle & high school students to learn more about cybersecurity, picoCTF was created in 2013. picoCTF is a “capture the flag” computer security exercise built on top of a video game that teaches students technical skills such as reverse engineering, forensics, cryptography, and binary exploitation. The challenges are specifically designed to be hackable and provide a safe and legal way to explore cyber security. Since the first competition in 2013, picoCTF has grown from around 2,000 teams to 8,000 eligible middle & high school US & CA teams and over 27,000 total global participants in the 2018 competition. Two key changes have been implemented since the competition’s inception to improve learning outcomes and increase student engagement. More introductory and intermediate difficulty problems were added to each category, gradually increasing in difficulty. Also, a new “classroom” feature was added to the competition that allows teachers to create internal scoreboards and track student progress. An analysis of the results of the 2018 competition shows that these new problems kept students engaged for more problems in the competition, and students with teachers who utilized the classrooms feature performed better than students with teachers who did not.

Problem-based Learning for Cybersecurity Education

Mandar Shivapurkar; Sajal Bhatia; Irfan Ahmed

Pages: 12

Problem-based Learning for Cybersecurity Education

Mandar Shivapurkar; Sajal Bhatia; Irfan Ahmed

Traditional lecture-based approach with laboratory-based exercises is commonly used to teach cybersecurity. It is useful to provide hands-on experience to students. However, it fails to provide students an opportunity to completely explore the multi-faceted and ill-defined problems prevalent in the real-world cybersecurity scenarios. Problem-based learning is a student-centered pedagogy in which students are presented with complex, open-ended, real-world problems to promote learning of concepts and principles, contrary to the traditional lecture-style presentations. Over the years, the model has been adopted to teach concepts in other disciplines including economics, business administration, architecture, law, engineering and social work, however, there has been little work done in the field of cybersecurity. This paper illustrates the use of problem-based learning for cybersecurity education. The authors believe that such a student-focused and active learning pedagogy will not only provide students an opportunity to learn relevant concepts, tools and techniques applicable to the given problem but also improve focus, interest, motivation, and foster lifelong learning skills, essential to survive in ever-changing cybersecurity field.

Serverless Computing Architecture Security and Quality Analysis for Back-end Development

Clark Jason Ngo; Peng Wang; Tuan Khai Tran; Sam Chung

Pages: 12

Serverless Computing Architecture Security and Quality Analysis for Back-end Development

Clark Jason Ngo; Peng Wang; Tuan Khai Tran; Sam Chung

The purpose of this paper is to propose how to improve both quality and security for the back-end of a modern software system through adapting to the serverless computing architecture. In order to achieve this, this paper will conduct the following three steps: 1) Show a complete back-end architecture using three serverless computing such as Amazon Web Service (AWS), Microsoft Azure (Azure), and Google Cloud Platform (GCP). 2) Analyze each component’s security and quality of each serverless computing provider and compare to show similarities and differences. 3) Describe how using a cloud service improves the quality and security of a system.

STEAM Powered K-12 Cybersecurity Education

J. D. Chase; Prem Uppuluri; Ellen Denny; Blenna Patterson; Jennifer Eller; Darlene Lane; Beverly Edwards; Rebecca Onuskanich

Pages: 16

STEAM Powered K-12 Cybersecurity Education

J. D. Chase; Prem Uppuluri; Ellen Denny; Blenna Patterson; Jennifer Eller; Darlene Lane; Beverly Edwards; Rebecca Onuskanich

The importance of incorporating cybersecurity education in K-12 to develop and strengthen the pipeline of students who pursue a cybersecurity major in college along with teaching cyber-awareness to all students cannot be overstated. Through efforts, such as the National Institute of Science and Technology (NIST) National Initiative for Cybersecurity Education (NICE) K-12 cybersecurity conferences and the NICE K-12 working groups this message is being spread to K-12 educators across the country. In Virginia, like many other states, there is a disparity among student and teacher preparation in cybersecurity between urban and rural areas. Schools lack two key resources: teachers with the required competencies and access to isolated computing networks – required for hands on exercises in security. Currently, efforts to introduce security are usually focused only at the high school level where students have already self-selected into relatively small interest groups. This paper describes the result of year-long, NSA funded project (PICSAR) designed to increase the number of teachers with competency in cybersecurity, while increasing the pipeline of students interested in cybersecurity. The project accomplished the first goal by providing graduate instruction in cybersecurity education and workshops to K-12 teachers. These same teachers then helped to accomplish the second goal through the development of age appropriate, integrated, STEAM lesson plans from Kindergarten through the 12th grade. For each topic in cybersecurity (e.g. Cryptography), a skills progression plan was developed and then lesson plans developed and piloted to appropriately introduce the topic at each grade level.

Synergy of ABET Accreditation and CAE Designation

Thomas Augustine; Haadi Jafarian; Ilkyeun Ra

Pages: 12

Synergy of ABET Accreditation and CAE Designation

Thomas Augustine; Haadi Jafarian; Ilkyeun Ra

One of the impediments to applying for the NSA/DHS Center of Academic Excellence in Cyber Defense designation is the fear that it will require a great change to the curriculum or may negatively impact international functional accreditations. This paper provides lessons learned while preparing to apply for this designation while maintaining and enhancing our international ABET (computer science) accreditation. We found synergy between the new cybersecurity requirements for accreditation and CAE designation. Additional benefits of CAE designation include standards which help design, build, market and assess strong, well-defined cybersecurity programs in both computer science and business, each of which caters to a different audience of students and future employers. Finally, the CAE designation requires collaboration inside and outside the University, encouraging a more active outreach to other programs. All of these benefits work in concert with the ABET accreditation which explicitly requires an internationally recognized curriculum that is taught by experts in their field and regularly assessed.

Teaching SDN Security Using Hands-on Labs in CloudLab

Xiaohong Yuan; Zhipeng Liu; Younghee Park; Hongxin Hu; Hongda Li

Pages: 12

Teaching SDN Security Using Hands-on Labs in CloudLab

Xiaohong Yuan; Zhipeng Liu; Younghee Park; Hongxin Hu; Hongda Li

Software-Defined Networking (SDN) represents a major transition from traditional hardware-based networks to programmable software-based networks. While SDN brings visibility, elasticity, flexibility, and scalability, it also presents security challenges. We designed a course to introduce the emerging topics of SDN/NFV related technologies to university students. Hands-labs on SDN security on CloudLab platform were used in the course. This paper describes the hands-on SDN security labs, and our teaching experience of the course. The hands-on labs can be adopted by other instructors to teach SDN security.

Using the NICE Framework as a Metric to Analyze Student Competencies

Jennifer Fowler; Nate Evans

Pages: 38

Using the NICE Framework as a Metric to Analyze Student Competencies

Jennifer Fowler; Nate Evans

This paper describes how the Department of Energy’s CyberForce Competition™ uses anomalies to map collegiate teams’ comprehension of different topics in cybersecurity. The competition is currently in its fourth iteration with a fifth planned in November 2019. Anomalies are challenges that collegiate teams must solve in order to receive points and vary in nature, timing, and skillset. All successful teams are able to manage the scale and prioritize which anomalies to complete. This paper identifies which National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework pillars students scored in the upper percentile, and which topics students averaged a lower score. These results may help educators in creating training programs, classes and curriculum to help close these knowledge gaps.


The Colloquium recognizes that the protection of information and infrastructures that are used to create, store, process, and communicate information is vital to business continuity and security. The Colloquium's goal is to work together to define current and emerging requirements for information assurance education and to influence and encourage the development and expansion of information assurance curricula, especially at the graduate and undergraduate levels.

24th Colloquium

June 14 to 17th - Baltimore Inner Harbor, Maryland

Details

Recent Posts

  • 17 November 2019 Assistant Professor, DePaul University DePaul University’s School of Computing invites applications for a tenure-track position at the rank of Assistant Professor to begin in September 2020.
  • 17 November 2019 24th Colloquium - Sponsorship Once a year, colleges that offer studies in cyber security, including those schools designated as Centers of Academic Excellence in Cyber Security, gather to discuss innovations and advancements in the…