• Xin Zhao, Zi Fan Tan

• November 13th
• 1:00 PM

In this talk, we'll present the development of apk-ai-dive, an AI agent designed to automatically analyze APK files for potential security vulnerabilities.

The talk is divided into four key sections.

• Why we need an AI Agent: We'll start by looking at the limitations of manual security reviews and explain why an AI-driven solution is a necessary step forward.
• AI Agent Fundamentals: Get an overview of the core concepts of AI agent architecture and the fundamental steps you need to take to develop your own.
• The apk-ai-dive Story: We will cover the complete development lifecycle of our agent, sharing the specific technical challenges we encountered and how we solved them.
• Making it More Useful: The talk will conclude with a look at how we enhanced the agent's functionality and user experience by building an interactive UI.

• Marcelo Guerra Hahn

• TBA
• TBA

Students are already using AI chatbots in our cybersecurity courses, and most faculty are reacting to that reality rather than designing for it. This session reframes the chatbot from an academic-integrity threat into a deliberate instructional tool, and walks through five concrete teaching patterns that any instructor can adopt next semester: the chatbot as a Socratic tutor and adversary role-player; generated vulnerable-code and "find-the-flaw" exercises for secure-code-review practice; scaffolding that meets the wide range of backgrounds in community-college and non-major classrooms; an on-demand copilot for interpreting tool output (nmap, Wireshark, log files); and, most importantly for our discipline, teaching the chatbot's own failure modes (hallucination, prompt injection, dual- use) as core security curriculum.

By the end of the session, attendees will be able to:

• Identify at least five distinct instructional roles an AI chatbot can play in a cybersecurity course and match each to a specific learning objective.
• Participate in a "find-the-flaw" or adversary-role-play exercise using a chatbot, including guardrails that keep it ethical and on-task.
• Recognize the chatbot's failure modes, hallucination, prompt injection, and dual-use, and teach them as security content in their own right.

• Pam Schmelz, Anna Blankenbaker

• TBA
• TBA

Linux administration remains a foundational competency for students pursuing careers in cybersecurity, cloud computing, systems administration, and information technology. While many Linux courses successfully teach command-line skills and system administration tasks, they often rely on highly structured laboratory exercises that encourage students to complete procedures without fully understanding the underlying concepts or developing the troubleshooting skills expected in professional practice. This course walk-through introduces the redesigned SVAD116 Linux Administration I course at Ivy Tech Community College, a fully online, Linux+ aligned course that combines authentic hands-on learning with learning-centered assessment, structured metacognitive reflection, and responsible integration of artificial intelligence.

The purpose of this session is to provide faculty with a practical walkthrough of a Linux administration course that can be readily adapted for community college and four-year cybersecurity, information technology, and computer science programs. Participants will examine the course structure, instructional philosophy, learning-centered assessment model, and instructional materials that embody the "Beyond Recipes" philosophy of shifting students from mechanically following step-by-step instructions to becoming reflective, confident, and independent technologists capable of reasoning through unfamiliar problems. The session will demonstrate how rigorous technical instruction can be combined with structured metacognitive reflection, individualized instructor feedback, authentic demonstrations of learning, and transparent AI guidelines while maintaining alignment with the CompTIA Linux+ and LPIC-1 certification objectives.

This session is intended for faculty teaching cybersecurity, cloud computing, networking, Linux administration, systems administration, or related computing disciplines. It is appropriate for instructors at both community colleges and four-year institutions who are interested in redesigning laboratory-intensive technical courses to increase student engagement and emphasize deeper learning. Although the course is Linux-focused, the instructional strategies presented are broadly applicable to many hands-on computing courses.

Specifically, the session showcases a redesign of a statewide Linux administration course that has been offered across Ivy Tech Community College since 2014. The redesigned version will be implemented beginning in Fall 2026. While students complete traditional hands-on laboratories using Fedora and Ubuntu virtual machines each week, this experience is followed by structured metacognitive reflections that encourage them to analyze what they learned, identify remaining questions, and document how they overcame challenges. Rather than assigning points to weekly activities, instructors respond to these reflections and lab submissions with individualized narrative feedback that supports student growth throughout the course. Midterm and final self-assessments invite students to evaluate their own learning and recommend a final course grade, with instructors validating those recommendations through constructive dialogue when needed. The course culminates in an authentic performance assessment in which students configure Ubuntu and CentOS 7 virtual machines and demonstrate their work through recorded presentations using Cengage Mindtap’s Bongo component. The course also incorporates the AI Assessment Scale to clearly communicate the appropriate level of AI use for each assignment, promoting transparent and responsible integration of generative AI into student learning. While the technical content aligns with the CompTIA Linux+ and LPIC-1 certification objectives, the course’s design philosophy intentionally emphasizes understanding, reflection, and troubleshooting over procedural completion. As students navigate through this course experience, they will not only learn from the instructional content; they will also learn by making mistakes and turning these into learning moments, which echoes work experiences.

The session will be delivered as an interactive course walk-through highlighting the shareable syllabus, weekly module organization, laboratory sequence, assessment model, AI Assessment Scale, and examples of structured metacognitive reflection prompts. Participants will have opportunities to ask questions, discuss implementation considerations, and explore ways to adapt elements of the course to their own programs. Attendees will receive access to the shareable syllabus and selected instructional resources to support implementation at their own institutions.

By the conclusion of the session, participants will be able to:

• Explain how learning-centered assessment and structured metacognitive reflection can be incorporated into laboratory-based computing courses.
• Apply an AI Assessment Scale to support responsible AI use in hands-on technical learning activities.
• Identify course components and instructional practices that can be adapted to Linux, cybersecurity, cloud computing, networking, and other computing curricula.
• Examine strategies that leverage mistakes as learning opportunities to mirror authentic workplace experiences.

• Ervin Frenzel, Richard Lightcap

• TBA
• TBA

This presentation introduces the Cybersecurity and Systems Engineering Model or CaSM, building upon the Maconachy, Schou, and Ragsdale model, as an integrative framework to organize current disciplines, theories, and professional knowledge as a systems thinking and engineering perspective. Ethics and risk are further established as critical to the cybersecurity field, especially when training young cybersecurity technicians in practice. Cybersecurity is commonly described as technically or adversarial based, this limits the broader organizational application which includes people, processes, and technology systems, all of which contribute significant risk to the organization. CaSM highlights cybersecurity is responsible for emergent systemic behavior based upon organizational constraints and systemic interactions including systematic evaluation of end-user behaviors as they engage organizational technology. Appropriate lenses include risk, people, processes, technology, and technology security as they overlap in a socio-technical and organizational system perspective versus simply replacing current theories.

The CaSM model is a structured approach to evaluate cybersecurity based upon the complex, systemic, humanistic environments in which cybersecurity is practiced through an integrative approach involving seminal and current disciplinary knowledge combined with target school curriculum and course descriptions. This evaluation is not determined by the school’s label of its program. Additionally, CaSM establishes an operational structure with imperatives, premises, and instructions to properly frame and train Artificial Intelligence assisted curriculum inquiries. The recommended evaluation process incorporates trans- and interdisciplinary knowledge areas such as ethics, risk management, systems thinking, systems engineering, socio-technical systems, leadership, management, behavioral sciences, project management, technology, and technology security.

• Ervin Frenzel, Richard Lightcap

• TBA
• TBA

This presentation aligns with the conceptual paper which the Cybersecurity and Systems Engineering Model or CaSM, building upon the Maconachy, Schou, and Ragsdale model, as an integrative framework to organize current disciplines, theories, and professional knowledge as a systems thinking and engineering perspective. Ethics and risk are further established as critical to the cybersecurity field, especially when training young cybersecurity technicians in practice. Cybersecurity is commonly described as technically or adversarial based, this limits the broader organizational application which includes people, processes, and technology systems, all of which contribute significant risk to the organization. CaSM highlights cybersecurity is responsible for emergent systemic behavior based upon organizational constraints and systemic interactions including systematic evaluation of end-user behaviors as they engage organizational technology. Appropriate lenses include risk, people, processes, technology, and technology security as they overlap in a socio-technical and organizational system perspective versus simply replacing current theories.

The CaSM model is a structured approach to evaluate cybersecurity based upon the complex, systemic, humanistic environments in which cybersecurity is practiced through an integrative approach involving seminal and current disciplinary knowledge combined with target school curriculum and course descriptions. This evaluation is not determined by the school’s label of its program. Additionally, CaSM establishes an operational structure with imperatives, premises, and instructions to properly frame and train Artificial Intelligence assisted curriculum inquiries. The recommended evaluation process incorporates trans- and interdisciplinary knowledge areas such as ethics, risk management, systems thinking, systems engineering, socio-technical systems, leadership, management, behavioral sciences, project management, technology, and technology security. This conceptually aligned presentation is the class portion of the conceptual paper.

• Sadettin Boluk

• TBA
• TBA

Modern Wi-Fi clients are designed to hide through MAC randomization, reduced directed probes, and per-network private addresses. Yet before a device connects, it still speaks.

This talk introduces **Signal Remembers**, a Python-based proof-of-value tool for passive Wi-Fi reconnaissance and privacy exposure analysis. The tool listens to 802.11 management traffic, builds an AP map from beacon frames, extracts Information Elements from probe and association frames, and compares randomized MAC identities using IE semantics, packet size, sequence behavior, timing, and channel context.

The core idea is simple: even when the MAC address changes, the device’s wireless behavior may remain linkable.

Through a controlled lab demo, we will show how passive wireless metadata can reveal SSID exposure, privacy leakage, and probable same-device candidates without authentication, decryption, or direct client interaction. The talk also introduces an AI-assisted scoring module trained on IE-level Wi-Fi fingerprints to improve correlation accuracy and reduce false positives.

This is not a tracking product. The goal is to help defenders, researchers, privacy engineers, and red teams understand what Wi-Fi clients still expose by default.

• Stephen Miller

• TBA
• TBA

The purpose of this presentation is to introduce how smaller institutions of higher education and community colleges contribute greatly towards the progression of economic and computing workforce in the nation.

Flourishing curiosity in fields such as computer networking and cloud computing has led to the support of advanced cyberinfrastructure practices in research and academic projects at these smaller institutions of higher education. The Building Research Innovation at Community Colleges (BRICCs) approach serves as an uncommon opportunity to study and analyze campus computing practices at smaller institutions and community colleges. This approach focuses on learning about current problems, collaborating with smaller institutions to facilitate solutions, and presenting its conclusion to the broader research community. In order to champion partnerships between experienced cyberinfrastructure professionals and smaller institutions, BRICCs will host virtual and in-person community workshops. These workshops will serve to strengthen the effect of cutting-edge cyberinfrastructure on campus computing. Learning resources, support for future funding, workshop reports, and networking models that reflect the research and academic goals of smaller institutions will be created by BRICCs. The approach serves as a cooperative space for discourse regarding challenges in the progression of cyberinfrastructure adoption in educational and research settings.

The BRICCs approach encompasses the unified efforts of various institutions, ranging from R1 universities to community colleges. It will create and fortify relationships between larger universities and smaller institutions of higher education to ensure the progression of computing and economic development. BRICCs offers the opportunity to expand and develop a comprehensive platform to the national level.

Building Research Innovations in Community College in TX (BRICCs-TX) is designed to help Texas community colleges prepare their students for research and data analytics that is required to be successful both in the workplace as well as in the attainment of higher degrees. It is more efficient and effective if educational institutions at all levels collaborate to share tools and resources, all institutions of higher education have access to the same information.

• Matt Bentz

• TBA
• TBA

For over a century, we’ve been making the same ridiculously simple mistake: cramming control signals onto data channels. From telegraph lines to modern AI systems, this antipattern keeps haunting our infrastructure. Are some design choices just too tempting to ignore?

In-band signaling—using the same channel for both data and control—is elegant in theory but fragile in practice. When an attacker can inject malicious control sequences into what should be pure data, you get the entire history of hacking as a catalog of mitigations. From the 2600Hz frequency that broke AT&T’s telephone network to the ASCII commands that powered early modems, from SQL injection payloads to prompt injections in LLMs, the patterns are remarkably consistent.

This talk traces the evolution of in-band signaling across six decades of computing history, showing how each generation reinvented this fundamental vulnerability. We’ll explore the telegraph’s framing problems, the blue box revolution that exploited dual-tone signaling, the modem protocols that fell to control characters, and the network protocols that required careful sequence management. Along the way, we’ll examine the cultural moments when in-band signaling shaped hacker history—and how different communities developed distinct strategies to isolate control from data.

The deeper lesson isn’t just technical—it’s about why we keep choosing convenience over correctness. Von Neumann’s architecture forced us into this bind, and while we’ve built separate channels in many systems, the fundamental tension remains. The question is whether we can finally escape the in-band antipattern, or whether our future will be shaped by new generations of the same mistake.

• John Sands, Jiri Jirik

• TBA
• TBA

As generative AI tools rapidly reshape the landscape of teaching and learning, faculty face twin pressures: protecting academic integrity and preparing students for an AI-rich professional future. This interactive workshop equips instructors with concrete strategies to design AI-resistant assignments that still embrace ethical, pedagogically sound uses of AI. Participants will learn and apply the AI-Resistant Assignment System (AIAS) framework to redesign one of their own course assignments, draft or refine syllabus policies on AI use, and identify AI literacy competencies aligned with their programs and disciplines. Through hands-on redesign activities, case studies, and structured peer feedback, attendees will leave with ready-to-implement assignment templates, assessment strategies that surface students’ own thinking, and a 90-day implementation plan they can bring back to their departments.

By the end of this workshop, participants will be able to:

1. Explain key dimensions of “AI-resistant” assessment and distinguish them from AI-detection–only approaches.
2. Apply the AI-Resistant Assignment System (AIAS) framework to redesign at least one existing assignment in their own course.
3. Draft clear, student-facing syllabus language that articulates expectations and boundaries for AI use.
4. Integrate at least two AI literacy competencies (e.g., prompt evaluation, bias awareness, transparency in AI use) into their course or program outcomes.
5. Develop a 90-day action plan to pilot, assess, and iteratively improve AI-resistant assignments in their context.

• Nancy Stevens

• TBA
• TBA

From Data to Decisions: AI Systems and Cybersecurity

Technology is most beneficial when users understand both its capabilities and its limitations, and recognize that every system can fail, be manipulated, or attacked. We have created a series of lessons inviting students to look “under the hood” of AI to explore how data, models, and system infrastructure work together to produce decisions and where vulnerabilities can emerge. By developing this understanding, students can become more critical users of AI, make informed decisions about when it deserves our trust, and better understand how AI can be both a tool and a target in cybersecurity.

Workshop Objectives:

1. Teachers will review a roadmap of AI + Cybersecurity lessons.
2. Teachers will describe how data enables AI systems to make predictions, recommendations, and decisions.
3. Teachers will examine model lessons to see how AI and cybersecurity concepts can be taught through hands-on activities.

• Melissa Dark, Mark Emry

• TBA
• TBA

Participants will be introduced to the cross-cutting concepts that shape a cybersecurity mindset, as defined in the CSEC 2017 curricular guidelines and CSEC Foundations Supplement. The concepts are: systems thinking, adversarial thinking, risk, defense in depth, and Confidentiality-Integrity-Availability.

The workshop will:

1. Unpack what each concept means in practice;
2. Explore why it is a cornerstone in cyberseecurity, and
3. Give teachers hands-on time to apply the concepts to a handful of existing lessons, so they leave with concrete ways to weave these themes throughout their courses rather than treating them as a standalone unit.