4
$\begingroup$

When someone says we should teach "cyber security" what does that mean to you? Is it computer science or system management or some mix of the two? What would you include in a course on cyber security that would make it a real computer science course?

$\endgroup$
  • 3
    $\begingroup$ It would be good if you could say a bit more about your expectations for the course and the backgrounds students would have, both in math and computing. Are you looking for just an overview of the field, or for the students to have some level of technical or operational knowledge at the end? $\endgroup$ – Buffy Jul 30 '17 at 23:21
  • 1
    $\begingroup$ I've downvoted this question because it sounds too broad for a single answer to cover. You could write a book on teaching cybersecurity. You might be able to narrow this question by elaborating on what you mean by "real computer science". $\endgroup$ – thesecretmaster Jul 30 '17 at 23:35
  • 1
    $\begingroup$ I'm really looking for what others think is "real computer science" and "Cybersecurity." It was deliberately written broadly because I didn't want narrow answers. $\endgroup$ – Alfred Thompson Jul 31 '17 at 13:22
  • 1
    $\begingroup$ As nobody really agrees what cyber security is, I think you will not get simple answers that will fulfil your requirement. $\endgroup$ – Rory Alsop Aug 1 '17 at 14:21
5
$\begingroup$

The course that I offered was all about gdb, hexdumps, buffer overflows, and format string vulnerabilities. As a textbook, we used Hacking, by Jon Erickson. AP CS A was a prerequisite of the course, though I permitted students to join the class if they were currently enrolled in that course, as long as we had a discussion outlining expectations first. There were no mathematical prerequisites.

The course was designed with the assistance of a Navy officer. The students practiced fuzzing and hacking (admittedly insecure) programs on old, virtual systems. This was quite deliberate! I didn't start by asking, "what will the kids be able to gain entry into at the end?" Instead, I posed this question to the officer: "High school students are also quite young, so there is little pressure to give them useful skills right now. CTF competitions abound, and my students are already joining those. What is hard to pick up from CTFs, but nevertheless is ultimately quite central? What can we offer them that will help them develop into top minds in this field in the future?" And that became the central mantra of the course.

Everything was done by hand at a *nix prompt, and they got a fair amount of practice reading and examining hexdumps. By the end, they could look at a hexdump and see at a glance where, for instance, the text strings were stored.

It was ultimately a computer science course on binary and hexadecimal, on system variables, and on the intricate operations of a runtime stack. As an additional bonus, they all got pretty adept at navigating a bash prompt. The students kept asking for network hacking as well, though we didn't have time to get that far.

The material was quite dense and unintuitive. (Though, I suppose, if these practices were intuitive, they wouldn't have been vulnerabilities in the first place.) It was an extremely difficult class, although the material itself kept the kids pretty interested, so you will have that working in your favor if you go down this road.

$\endgroup$
5
$\begingroup$

I have taught various levels of Information Security, from basic security at schools and university to "extreme hacking" for experienced professionals at global security consultancies. Currently I'm the Research Director for ISACA Scotland, with a remit to work with Education to build syllabi and training for the next generation of security practitioners, and I have a fairly broad view on what should be incorporated here. It does make for multiple books, but as headline topics, I'd suggest:

  • networking
  • system architecture (Windows, Unix, others)
  • a variety of languages (assembler, Object Oriented, classic languages such as COBOL, Forth, java etc)
  • Security concepts (safes, locks, alarms etc) and their relationship to cyber concepts (firewalls, IDS etc)
  • entry level Crypto
  • capture the flag
  • red and blue teaming
  • social engineering
  • containers, virtualisation, cloud and everything-as-a-service
  • logs and logging
  • forensics

But there is so much more you could add in... Probably worth getting the syllabus from various universities and schools with security faculties, and build from them.

And more importantly, visit Security Stack Exchange where security queries can be tackled by heaps of skilled and experienced security practitioners.

$\endgroup$
  • 1
    $\begingroup$ An interesting answer. Welcome to Computer Science Educators! $\endgroup$ – ItamarG3 Aug 1 '17 at 14:25
  • $\begingroup$ Thanks - as a disclaimer, I'm one of the Security Stack Exchange mods :-) $\endgroup$ – Rory Alsop Aug 1 '17 at 14:25
  • $\begingroup$ Oh, I know ;) (I looked around other sites a while back :D) $\endgroup$ – ItamarG3 Aug 1 '17 at 14:26
  • 1
    $\begingroup$ Lol. I wasn't aware of this site until now, so I'll stick around and see if I can help. I'm a bit niche though - never taught broader comp sci, just sec. $\endgroup$ – Rory Alsop Aug 1 '17 at 14:35
  • $\begingroup$ Why not come by out chat $\endgroup$ – ItamarG3 Aug 1 '17 at 14:35
1
$\begingroup$

An important and fairly contained topic is to introduce the impact of technology changing. As software designers, we will make assumptions which have a critical impact on security. Bunnie interposed a break-out connector on his Xbox ROM, and now we have OpenCV to read ROMs directly. Assumptions about how much crypto $100 of compute will buy you change (sometimes in big steps - 10 years ago, you couldn't buy fast cycles without buying the hardware yourself). BGA reflow used to be an expert operation (with X-ray analysis), now people go it in their toaster...

These changes over time mean that the attack surface will also tend to expand - complex indirect hacks can become trivial.

The impact of this is that any secuity system which can't be updated will become insecure - fairly certainly.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.