14

Make it into an assignment/game. Each student creates a project that is passed to another, randomly chosen student, to hack. Give points for both the project and the "hacking" results. The hacking assignment should also be graded. Security has to be taught and the value learned, usually painfully. I have lived through many "no one will do that!" only to ...


10

I like your locksmith comparison, but I don't agree with the following assertion: From there, we arrive at this fine distinction: if a security feature is designed to keep you out, even if that security feature is very poorly implemented, then it is almost always unethical to circumvent it. Therefore, we should only study hacking using "practice locks", ...


7

Yes. You should absolutely identify the specific risks of each technology or tool that you are going to teach and discuss those risks before you assign students to use those technologies or tools. The exact form of these warnings depends on what exactly you are introducing and the age of the students. This is also a decision that should be made in the ...


7

I taught a Cisco networking class for a couple of years and we had to stay off of the district network any time we were doing networking stuff. What I did was build a separate network in the middle of my room with old computers. Ran network drops from there to the racks in the back of the room so we could hook into switches, routers, and stuff. Once we ...


7

Viruses, worms and other malware are actually just like physical infections in enough ways that I still think metaphors are the best way to educate from a basic level. Even the average home user knows that a virus scanner stops a large number of infections from ruining their PC. The challenge comes with explaining why virus scanners are so limited - most up ...


6

First please be very cognizant of the term "hacking" Some of what you are describing is "cracking" not "hacking" The techniques may be the same but the intent is different. I think you are having problems with this because you yourself aren't comfortable with making this distinction. You cannot prevent someone who is rotten to the core from taking your ...


5

The course that I offered was all about gdb, hexdumps, buffer overflows, and format string vulnerabilities. As a textbook, we used Hacking, by Jon Erickson. AP CS A was a prerequisite of the course, though I permitted students to join the class if they were currently enrolled in that course, as long as we had a discussion outlining expectations first. ...


5

I have taught various levels of Information Security, from basic security at schools and university to "extreme hacking" for experienced professionals at global security consultancies. Currently I'm the Research Director for ISACA Scotland, with a remit to work with Education to build syllabi and training for the next generation of security practitioners, ...


4

I don't see any particular problems with your syllabus. However, I do see two challenges that you will need to overcome. Depending on other factors in your context these may be easy or hard. But there is a lot you don't say that would permit a better set of suggestions; how many students and how motivated they are, for example. I'll address that at the end. ...


4

I go ahead and use something a little dramatic in my sessions. I use the vampire mythology to explain viruses. For instance, vampires only come in when invited. Viruses are the same. The user has somehow allowed the virus to be installed on their machine. This 'invitation' part puts an emphasis that viruses entering a machine is almost always a fault of ...


4

I would go about detailing how much profit a white hacker can get, seeing as many security companies hire them as test attackers. If any of the kids are tempted be unethical things, then explain that far greater profit can be achieved with greater ease if one chooses to use their learning for good. So that's that (for any student saying "But I can make a ...


4

As mentioned in other answer making education like a game is good idea. You can use SQL Injection as one of the examples, other like password to be word from the web page itself, other can be default username/passwords like root/root, admin/admin and so on. During the class you mention this keyword (SQL for example) and give them as home work URL to dig. ...


4

It's certainly ethical to teach the existence of such tools. It's only unethical if the teacher neglects to teach the legality of these tools along with their existence, or if the teacher advises students to use the tool in an unethical way. It's rare that a tool is not ethical, it's more common that a use of the tool is not ethical. It's ethical because ...


4

In general is is unethical to teach people skills that they intend to employ to harm others. That said, it is hard to know the intent of your students. Do you have Beavis and Butthead in your class? Pretty problematic then. But many people the age of secondary school students make a lot of judgment mistakes. (The human race probably wouldn't exist if most ...


3

Teaching about the existence of such tools is totally ethical. We need people who understand computer security, period. Mentioning the law is also almost self-apparently necessary. In my district, I am lucky, because I can get folks from the district IT staff to run the port scanner in front of my hacking class and discuss the results themselves. No one ...


3

This seems insufficient to me, because of the following example at a minimum: In small towns, people do not lock their doors, or at least they did in bygone days of yore, or so the story goes. If you steal from a house where the door is unlocked, is that suddenly somehow not unethical? What if there was no door on the house at all? If the stuff was just ...


2

I would just try to make resources available to them and make sure to give examples of what not to do (e.g. Your example). In terms of resources, I'd provide info about attack vectors, threat models, etc. Specifically I'd provide the OWASP top 10.


2

Emphasize the 'stupidity' of security holes - they aren't weaknesses that only geniuses with a bone to pick can root out, they're the same mistakes repeated ad nauseam between different companies, therefore every application is liable to run into them. Using the CWSS (common weakness scoring system) the highest priority vulnerabilities are SQL Injection, OS ...


2

Security vulnerabilities are just bugs. In your example the code does not do what it is supposed to do (keep the bad people out). So treat them this way. “We have a bug. The program does not meet its security requirement of …”. The worse thing we can do (and I have seen this in classes), is to demonstrate bad code, unless it is part of a “What is wrong ...


2

You may have to rethink the curriculum design at a higher level ( involving other staff ). Do you kick people off the course, loosing revenue. Do you teach extra lessons to get them up to entry level, extra cost. I think it is a good idea to teach Unix. it is a very consistent operating system, making it easier to learn. However there is an initial ...


2

I'm not sure how engaging these would be, but as a source of exercises and practice content, you might look towards IT professional certifications. There are things like A+ (general IT), Networking+, CCNA (Cisco), or MCSA (Microsoft sys admin), among many many exams that are quite popular and have a variety of study resources online. This PCWorld article ...


1

Have you considered a practical example like teaching PGP email encryption? Keybase.io has a browser based crypto solution for doing encryption / decryption and while I don't recommend for "real" crypto, it is a great convenience tool for showing how public/private key encryption works without the need to address pgp tools installed on a machine or access ...


1

I thoroughly recommend Cryptool2. It's an open-source GUI where you can drag and drop different algorithms, inputs and outputs and see the results in real time. It can be used to show very basic caesar cypers to customizing advanced encryption and hashing techniques.


1

There are some engaging lessons on encryption in Unit 4 of the AP Computer Science Principles curriculum from Code.org. Lessons 5, 6 & 7 take students from the concept of encryption using a caesar cypher, to a vigenere cypher, and then through the concepts of public key encryption. Students usually have fun with the widgets that interactively ...


1

To explain what a virus is, it is easier to also explain what a virus scanner is. A virus is malicious software, that takes advantage of bugs in you computer's operating system, and applications. They can combine this with social engineering, to manipulate you into cooperating with the virus. One way to protect yourself is to use a virus scanner. What is a ...


1

An important and fairly contained topic is to introduce the impact of technology changing. As software designers, we will make assumptions which have a critical impact on security. Bunnie interposed a break-out connector on his Xbox ROM, and now we have OpenCV to read ROMs directly. Assumptions about how much crypto $100 of compute will buy you change (...


1

If students are learning penetration tools and techniques, they should first be required to learn, at a minimum: What is illegal and the civil, criminal, and professional penalties (I have students sign a statement that they have been told that any attempt to achieve unauthorized access to computing resources can result in felony conviction with penalties ...


1

I would have a "guest lecturer" who was a cybersecurity professional teach one class. (Maybe I would give a test on the lecture the following day.) Most CS instructors are aware of security problems connected with software, but not all of them understand the hardware issues. Unless you happen to have a professional cybersecurity background, you may be ...


Only top voted, non community-wiki answers of a minimum length are eligible