Teaching information security to students without basic IT knowledge

Question

Context

I've been mandated by the university of Tokyo to teach Information security courses during my working hours (initiation level). We are 3 teachers, 2 security researchers employed by the university of Tokyo and a tier Infosec engineer with some practical experience (me).

I'm responsible of the workshop sessions. My main goal is to ensure that they can practically apply and test the things they learn with the other 2 researchers.

The first session I gave was about building and configuring their own workplace and just made sure the students correctly followed the manual I wrote. Yesterday I gave the second session (where the fun things should start). This is when i discovered that 70% of my students have no basic IT knowledge.

The problem

• Most of the students don't understand a single word during the theoretical part of the course (the researchers class, i have no impact on what can be taught there). The 2 security researchers doesn't care.

They say: It's not our fault if the students don't have the necessary knowledge for understanding us, they should work harder at home. And we are busy with our research.

• In the workshop sessions (My class) the students are completely lost. They are trying to do things that they totally don't understand.

What am I planning to do ?

• Divide the workshop sessions into 2 parts. Teaching IT Basics and the normal workshop (one hour each).

IT Basics course plan

This course will be divided into 3 parts: programming, system administration and networking.

General rules:

• No mouse allowed, only keyboards.

• No User friendly OS allowed and of course no GUI. OpenBSD and VIM for everyone.

Programming (15 hours)

• Introduction to C (12 hours)
• Introduction to Perl or Python (3 hours) <- not sure yet

Networking (10 hours)

• OSI Model & TCP/IP Model (3 hours)
• Common protocols ( 2 hours )
• HTTP in depth (2 Hours)
• Sockets & Web Socket (1 Hour)
• Packet capture and .pcap analysis (2 hours)

System Administration (10 hours)

• Hardware & computer parts roles. (1 hour)
• Difference between UNIX, GNU/Linux, DoS. POSIX Standard (1 hour)
• UNIX Based system initiation (1 hour)
• Common UNIX Administration commands (2 hours)
• System calls (2 Hours)
• File descriptors and PIPE (2 hours)
• Process & thread (1 hour)

I have 80 hours with this class. 4 (sometime 6) hours per week on 6 months. I'm intending to use ~35 hours for teaching basics. There is no way I will let my students cook security related operations without them understanding what they are doing.

The question

Is the IT basics course plan is good enough for understanding basic infosec ? (Should I add or remove topics, is 35 hours not enough or too much..)

I'm very new into the infosec teaching field, not very sure I'm doing this right...

I do not seek opinion based answers, but testimony of accomplished teachers who have watched their students grow from IT enthusiast into promising engineers.

EDIT

---

The students

A class of 26 persons. All graduated a bachelor degree, not in the IT Field for most of them. All Japanese, so I teach in Japanese.

Yes, they are motivated, well at least they are highly active in class. I don't know if the infosec field interests them or interacting with a non-Japanese teacher is somehow fun.

They ask me tons of questions, all IT related. Those questions pointed out a general lack of IT engineering basics knowledge. For being sure I wrote a short test, and as expected the results were not good. (Recently teach them how to convert decimal to binary and hexadecimal without tools.)

The other teachers

All researchers and Japanese. My students are somehow afraid to ask questions during other class lecture, looks like I'm their personal stack exchange website.

I spoke with the other teachers, and I somehow understand my students. The youngest teacher is 49, and I feel like teaching is an obligation for them, they don't want to. Writing papers on subjects that don't matter anymore is what they like.

The diploma

Yes, they are all preparing a master degree in computer science. The majors differ though (Architecture, software, system administration, security...)

From my opinion, The Japanese educational system is pretty odd. I mean how come graduating a bachelor degree in economics or marketing can let you attend a master degree in computer science? The IT fundamental I will try to teach them is a knowledge any future engineer should acquire during a bachelor degree, not a master. At least in France. And I feel like this is somehow the same in Europe or USA.

From my point of view, basic IT knowledge is the fundamental you need to understand computer Science Masters degree's class

My profile

I'm not an academic person. Well, I'm a security engineer with 10 years of practical experience, not really a researcher. I know the actual needs of corporation in term of security, how attacker thinks and proceed, How to defend against them... This what I should teach, how it works out there in a practical way.

I'm 34 (French), pretty close to my student's age. This is my first time teaching at master degree level.

I don't know if this feeling is right but I somehow feel responsible for my students Future.

Answer 1

I don't see any particular problems with your syllabus. However, I do see two challenges that you will need to overcome. Depending on other factors in your context these may be easy or hard. But there is a lot you don't say that would permit a better set of suggestions; how many students and how motivated they are, for example. I'll address that at the end.

• The first challenge is that much of what you want to do in the basic knowledge part is actually prerequisite to everything else, and yet you say you want to split the workshop time between that basic knowledge and the skills part. It isn't obvious that the students will know enough of the basic stuff to do much in the skills. That is just as it is now, of course. Meanwhile, the other instructors will be moving through their material, putting a bigger load on the students. It might lead to frustration. You will need to assure, somehow, that the students have the knowledge they need when they need it. I think this will be your main challenge.

• The second challenge involves how you intend to teach the basic stuff. If you only lecture and show a lot of Powerpoint slides, I see a scenario in which they know just as much at the end as they do at the beginning, having learned almost nothing. If, instead, you make the students very active I would predict better outcomes. Since you suggest this happens in a workshop setting, I think you have the possibility to make it work, so long as you make them work through a lot of exercises for every syllabus point.

As a technique, I'd also recommend that they do a lot of paired and team work, rather than individual work. They can help you teach by helping one another to learn - working on those exercises. It will also be an advantage to their later work if they are to work together after the course ends. The more students you have, the more important this will be, since you will become a learning bottleneck otherwise. The more students, the more questions. You won't be able to answer all of them in the available time. Teams will help here.

Finally, it wasn't clear to me, the reader, how motivated the students are. Things will work better if they are already highly motivated, of course. But if that is not the case, and they really should work harder, as your colleagues imply, then you have another problem that you should attack. One way to do that is to try to introduce some human, even fun, elements into your teaching. One useful Organizational Pattern, for example is "Do Food" which suggests providing food at the workshop sessions. That book, by the way, has a lot of other suggestions that will probably help you improve the situation if it is poor. In your case InfoSec is the big new idea you are trying to introduce. But you can increase the motivation by making the workspace more human (and humane).

Answer 2

You may have to rethink the curriculum design at a higher level ( involving other staff ).

Do you kick people off the course, loosing revenue. Do you teach extra lessons to get them up to entry level, extra cost.

I think it is a good idea to teach Unix. it is a very consistent operating system, making it easier to learn. However there is an initial unfamiliarity. Therefore, if students are familiar with MS-Windows, then link to it. Show how MS-Windows copied (badly) from Unix \ in stead of /, and why. Because they had already used / before they implemented directories. (Interestingly Unix made the same mistake > had already been used, so they went for /.

I would avoid Vim (I love Vim and Emacs), but why make things difficult?

You may need to cut it down, doing C, and other programming, as well as shell may be too much. At least at first.

Check with the bosses, on what is expected by the end of the course. If this is not feasible then you need to push back, to get thinks changed.

Details of time spent on my 1st year (1991-1992) undergrad course, in the module of computer applications.

In the hope that this will show what can be done in this time. Summarised from the handouts.

This module was, mostly, not about computer security. However it is a prerequisite. I have it here as it is similar to the basics you talk about in the question.

You will not have to teach it all, as some is not relevant.

• Total Time: 20hours lectures (one per week) + 50 hours lab + extra off timetable (We were expected to put in at least the same number of hour again in self study).

• Architecture

  • Memory, processor, input, output, storage, network
  • File system hierarchy
  • Data representation: Denary, Binary, Hexadecimal, Octal, Binary coded decimal, ascii, parity
  • System software

• MS Dos and Windows (Version <= 3 )

  • Dos commands, file types
  • Viruses
  • History of the PC
  • MS windows
  • MS word
  • Fonts
  • Copyright
• Unix (Sun OS)
  • What is an OS
  • History of Unix and C
  • Logging in, passwords, changing passwords.
  • Unified file system hierarchy
  • Command line
    • commands: cd, pwd, ls, cat, more/less, cp, mv, rm, man, date, who, wc, ps, chmod, mkdir,
    • streams: stdin, stdout, stderr, redirection, pipes
    • printing, mail
    • vi
  • Boolean logic
  • grep, awk
  • Set theory, Regular expressions

Other modules

• In year 2 we did programming in C (20hours + 50hours lab)
• We also did OSI model in a different unit.