ASE '18 Workshop Program

Security competitions, a.k.a., CTFs, have never been easy to run for a classroom teacher despite there being considerable body of research on these events. It is often frustrating for teachers to organize and administer such an event as doing so requires significant time and human resource investments. Creating new problems for every CTF is challenging as there are many factors to consider while developing a CTF problem such as the difficulty level of each challenge. In this paper, we propose a simple, but effective approach that we refer to as Git-based CTF to hosting an in-class attack-and-defense CTF contest while minimizing the operational costs for teachers. We share our experience and lessons learned by organizing a Git-based CTF in KAIST.

Alternate reality games (ARGs) have been shown to have desirable characteristics for computer security education and student motivation. We implemented a 10-week-long ARG in an introductory undergraduate computer science course, and formally assessed the ARG's impact on students' course experience, as well as examined students' motivation-related experiences in the course by gender. Among other conclusions, we found that the ARG enabled an authentic and motivating problem-solving environment, but also raised ethical concerns among students that could lead to constructive discussions on ethical behavior in computer security. We also found that the ARG's use of several programming languages has detrimental effects on novice students---especially women---who felt at a disadvantage compared to their peers. We discuss connections to extant literature and implications for future implementations of the ARG.

It is clear that in order to address the cybersecurity education and workforce crisis, the challenges are not just numerous but also inextricably linked. The least of which include a greater number of prepared faculty, effective curriculum, and infrastructure to host, use, and disseminate the curriculum. There is a demonstrated need for a cybersecurity digital library (DL) that will help address these challenges. The Cyber DL is similar to other curricular digital libraries in some respects (material quality, uptake, etc.) and unique in others (national security concerns, presence of damaging material – malware, material integrity issues, etc.). We have been working on the design and implementation of CLARK – The Cybersecurity Labs and Resource Knowledge-base. CLARK is a prototype curriculum management platform that hosts diverse cybersecurity learning objects. This submission introduces the system and highlights its capabilities as a tool that is much needed in the cybersecurity education community.

Despite the abundance of free online resources and increased research into innovative educational techniques, the shortage of cybersecurity skills in the workforce continues. The skills gap in the specific area of industrial control system (ICS) security is even more dismal due to the higher barriers to entry raised by the exclusive use of expensive, proprietary hardware and software and the inherent dangers of manipulating real physical processes. To help beginners in ICS security overcome these barriers to entry we developed a graphical realism framework for industrial control simulations (GRFICS). GRFICS virtualizes entire ICS networks, from the operator interface down to realistic simulations of the physical process visualized in a 3D game engine. Using this framework, students can practice exploiting common ICS vulnerabilities and vividly see the physical impact in the visualization of the process. After gaining a better appreciation of the close relationship between the cyber and the physical worlds in ICS networks, students can then practice hardening the network against such attacks. This free and open-source framework can be used as the basis for formal classroom instruction, ICS-specific CTF competitions, or for independent study.

For the past three years, Cybersecurity Policy Fellows have been a major part of New America’s Cybersecurity Initiative. The fellowship provides a group of academics, practitioners, technologists, and others with a yearlong, non-resident fellowship with New America’s Cybersecurity Initiative. The fellowship is designed to enable Fellows to work creatively with the Initiative, each other, and the cybersecurity community to improve the quality of cybersecurity policy discussion.

See the fellowship application for more information.