Designing and implementing secure software is becoming very critical because various types of attacks take advantage of software vulnerabilities. In order to effectively teach students how to develop secure applications, we developed a Secure Program Design Education Tool to assist students in learning how to design and implement secure programs. This tool consists of three sections to help students understand what input flaws and buffer overflow are and how to prevent them. This tool is designed and implemented with a user friendly environment and uses examples to demonstrate the results of unsecure code and the purpose of secure program design. This tool has been used for an undergraduate Data Structures class fall 2019 in the Department of Computer Science at North Carolina A&T State University. Our experience exhibits that using this tool helped students not only better understand the concepts of input flaws and buffer overflow, but also gained significant skills to develop secure software. Students' survey and feedback reflected this tool is very valuable in their education experience. This tool could also be used in other sophomore level related courses.

Developing secure software applications is becoming very critical because many different types of attacks are caused by software vulnerabilities. In order to effectively teach secure software engineering, we have developed a course module titled “Introduction to Secure Program Design”. This paper presents the content of this module and reports our teaching experiences. This module was successfully taught in the COMP 280 Data Structures class during the Fall 2018 semester in the Department of Computer Science at North Carolina A&T State University. Our experience exhibited that teaching this module helped students not only gain knowledge and understanding about the impacts of input flaws and buffer overflows, but also they gained significant knowledge about the practice of designing secure programs. Students’ surveyed responses and feedback reflected that this module was very valuable towards their educational experience. This content could be taught in second year sophomore classes of software engineering, computer science and information technology.

Nginx is a commonly used and free open-source web server that is used as a reverse proxy server, load balancer and HTTP cache. It consumes less memory and can handle more clients with less number of processes. Nginx provides users with five predefined load balancing algorithms. However, most of these algorithms are static and some of the load balancing rules are inefficient. In order to make the load of a cluster more stable under high concurrent requests, we developed a Dynamic Load Balancing (DLB) algorithm that uses Nginx as a network security control panel to provide load balancing for a cluster of backend servers. The DLB algorithm is based on the weighted round robin module of Nginx, Logistic Regression and Maximum Likelihood Estimation (MLE) algorithm. It handles the situation of high concurrent requests and reduces the probability of omitted or under-reported incident and status. We also propose a Hybrid Load Balance Method (HLBM) that incorporates the DLB algorithm and evolutionary computing to further improve the performance. We have conducted limited experiment by using dynamic load balancing algorithm. We will complete to develop the Hybrid Load Balance method and conduct experiments for HLBM.

Local area network (LAN) access is the top vector for insider threats and misuses according to the Verizon's Data Breach Investigations Report. Address Resolution Protocol (ARP) is often exploited by the attackers who have gained access to the LAN. It is critical for students to learn how attacks on ARP work and know the countermeasures. In an earlier work, authors developed a hands-on lab to help students learn how an ARP spoofing attack works by asking them to create and send attack packets. To enhance learning further, we present an interactive visualization tool that intuitively shows the effects of the ARP spoofing attack in real-time. The Hacker Graphical User Interface (HGUI) is an interactive visualization tool developed to assist students in learning how ARP Spoofing works. By modeling a controlled ARP Spoofing attack using virtual machines, we give students the ability to alter elements of the attack by interacting with the visualization. This tool was developed using Processing, an open source programming language used in many visual art communities. It runs on virtual machines installed with Kali Linux. This tool animates attack packets, normal packets, and the status of ARP cache in real-time. If students have successfully carried out the ARP spoofing attack, they can see the normal packets being routed to the attacker machine and the victim's ARP cache being poisoned. In this paper, we present the design, implementation, and evaluation of the lab. Tests were conducted to measure the performance of students before and after using this tool. We also gave students surveys after they completed the hands-on lab. The result shows that this tool can significantly enhance students' understanding of the concept of ARP spoofing attacks and motivate them in learning more about cyber security.

The wide spread use of Internet allows advertisers to reach significantly more consumers through online advertisement compared to traditional advertising media. However, currently online advertisement is facing challenges associated with advertisement (ad) frauds such as ad replacement, ad stacking, click fraud, and click hijacking. It is important to teach students this emerging topic, and help students understand the attack flow behind ad frauds. In this work, a course module was developed to teach students about online ad servicing architecture, the associated security vulnerabilities and how the vulnerabilities can be exploited. A scenario of ad replacement was developed which includes an infrastructure to simulate the ad replacement attack flow providing students a real-world context and hands-on experience. This paper describes the course module on ad fraud, and our teaching experience of this course module. Instructors teaching network security, web security, information systems, and business & economics could adopt this course module.

Hands-on labs have been proved to be effective in improving students learning and motivation. This paper presents the results of an assessment study conducted to compare hands-on labs for teaching SQL Injection. Two hands-on labs were selected as control group and experimental group teaching methods respectively. The goal is to find out whether one hands-on lab is more effective than the other hands-on lab in terms of improvement in student learning outcomes, student motivation, and student experiences. Our study results can provide insights for instructors of cybersecurity in selecting appropriate teaching tools for their classes.

The poster describes our project of Assessing the Effectiveness of Experiential-Learning-Based Teaching Tools in Cybersecurity Courses. We are assessing the effectiveness of experiential-learning-based teaching tools for 10 cybersecurity topics in five cybersecurity courses. For each topic, two teaching methods are selected: the control group teaching method, and the experimental group teaching method. The two teaching methods are compared to answer one of the two research questions: (1) Is using an experiential-learning-based teaching tool more effective in improving student learning than the traditional teaching method without using the teaching tool? (2) Is one experiential-learning-based teaching tool more effective than another experiential-learning-based teaching tool? We will assess the effectiveness of the teaching methods via three measures: (1) improvement in student learning outcomes, (2) improvement in student motivation in learning the topic, and (3) improvement in the student experience such as student enjoyment, satisfaction, and perceived difficulty in learning the topic. The knowledge gained from this research can be used by cybersecurity educators at other institutions to use effective teaching tools to improve cybersecurity education practices, which has the potential to increase the number of students well-prepared for entering cybersecurity careers.

In this paper, we present two teaching methods that are control group teaching and experimental group teaching to show how using Cybersecurity education tools to help students learn related topics. We develop an effective Cybersecurity Education Tool Assessment Method (CETAM) to measure effective of the teaching methods and evaluate these education tools. We adopt two different teaching methods with selected Cybersecurity education tools to Web Security class in Spring 2016. We use CETAM to measure the effective of the teaching methods and evaluate selected tools by student learning outcome, student motivation and student experience. The experimental results show the impacts of two different teaching methods and selected Cybersecurity education tools.

OpenEMR is a widely used open source electronic medical record system. Since it is used for storing and transmitting sensitive health information, the security posture of the system is of great concern. This paper reports our findings of vulnerabilities in OpenEMR 4.1.1 using various approaches. We analyzed the authentication function of OpenEMR, conducted session ID analysis, source code analysis, black-box testing, scanning with vulnerability assessment tool, as well as testing based on attack patterns. The vulnerabilities discovered include potential authentication vulnerabilities, lack of input validation, cross site scripting, HTTP Parameter Pollution, Server Side Include (SSI) injection, etc. This case study could be adapted into hands-on exercises for teaching software security testing methods.

Developing abuse cases help software engineers to think from the perspective of attackers, and therefore allow them to decide and document how the software should react to illegitimate use. This paper describes a method for developing abuse cases based on threat modeling and attack patterns. First potential threats are analyzed by following Microsoft's threat modeling process. Based on the identified threats, initial abuse cases are generated. Attack pattern library is searched and attack patterns relevant to the abuse cases are retrieved. The information retrieved from the attack patterns are used to extend the initial abuse cases and suggest mitigation method. Such a method has the potential to assist software engineers without high expertise in computer security to develop meaningful and useful abuse cases, and therefore reduce the security vulnerabilities in the software systems they develop.

Cloud computing offers on-demand scalable resources and IT-based solutions without the need to invest in new infrastructure or train new personnel. Despite its economic advantages, cloud computing has faced scrutiny regarding security risks involved with allowing sensitive data to be controlled and handled by third-party, off-site vendors. Many businesses with interest in using cloud services do not have a process to assess cloud providers security posture. To aid this issue, the Cloud Security Alliance (CSA) has developed the Consensus Assessments Initiative Questionnaire (CAIQ), which has quickly become an industry-accepted way to document security controls found within cloud services. The CSA CAIQ document provides prospective clients an in-depth look into the security controls of a given cloud service provider (CSP). The assessment process is very complicated because it requires clients to examine over 140 questions spanning over eleven security control categories in CAIQ, answer yes/no followed by explanatory comments related to the corresponding question. How cloud consumers can objectively use the CAIQ to assess CSP security levels becomes an important and urgent problem. A Fuzzy Likert System (FLS) was employed that uses fuzzy logic, Likert scales and decision making technologies to assess the Security Posture Score (SPS) for cloud service providers based on client evaluations of CSP feedback on the CAIQ document and client-defined weights signifying the relative importance of each CAIQ category. The FLS allows clients to numerically evaluate the CSA CAIQ and provides weights for each CAIQ category. Upon doing so, the FLS provides a score indicating the security posture of the given CSP. A one-tailed F-test is used to perform a statistical analysis comparing the standard deviation between 1000 random SPSs calculated with our FLS and a traditional weighted-average system. Experimental results indicate that the null hypothesis, which states that the two standard deviations are the same, can be rejected in favor of the alternate hypothesis, thus claiming that with 95% confidence there is a significant difference between scoring methods.

An application logic flaw is a type of software vulnerability related to privilege manipulation or transaction control manipulation. They are often difficult to identify using automated scanners. A case study on the eCommerce merchant software Bigcommerce, integrated with PayPal Express as a third party payment collector, was created to teach students about this topic. Case studies provide students with a real-world context, and help them understand complex topics better than traditional teaching methods. However, the computer science field, especially computer security, does not have many case studies available. The case study on logic flaws in software was taught in Spring 2015, and the teaching experience is discussed.

Cloud computing is an emerging technological paradigm that offers on-demand, scalable, resources and IT-based solutions without the need to invest in new infrastructure or train new personnel. Cloud computing has faced scrutiny regarding security risks involved with allowing sensitive data to be controlled and handled by third-party, off-site vendors. Many businesses with interest in using cloud services do not have a process to assess cloud providers security. In this paper we categorize cloud computing threats into external threats, guest-to-guest threats and cloud-to-guest threats; discuss the new version of the Consensus Assessments Initiative Questionnaire that was developed by the Cloud Security Alliance; propose a Fuzzy Likert Provider Security Measurement prototype that uses fuzzy logic, Likert scales and decision making technologies to assess the cloud service providers' security.

A vulnerability management tool, named A Software Application Vulnerability Management Dashboard System (SAVMDS), has been developed. The SAVMDS provides a user-friendly mechanism for managing software application products vulnerabilities. It provides functions to support Administrator, Chief Information Security Officer, Information Security Officer, Business Line Owner and Business Manager to record software application products vulnerabilities, analyze possible risks based on existing vulnerabilities and make smart decisions. The system has been implemented and tested. The experimental results demonstrate that due to its simplicity, a user with limited computer technical skills and knowledge can use it easily. It provides visual presentation to allow users to see different views of information in a single place and generate results that are easy to understand.

To improve the security of computer systems, information, and the cyber space, it is critical to engineer more secure software. To develop secure and reliable software, software developers need to have the mindset of an attacker. Attack patterns such as CAPEC are valuable resources to help software developers to think like an attacker and have the potential to be used in each phase of the secure software development life cycle. However, systematic processes or methods for utilizing existing attack pattern resources are needed. As a first step, this paper describes our ongoing effort of developing a tool to retrieve relevant CAPEC attack patterns for software development. This tool can retrieve attack patterns most relevant to a particular STRIDE type, as well as most useful to the software being developed. It can be used in conjunction with the Microsoft SDL threat modeling tool. It also allows developers to search for CAPEC attack patterns using keywords.

The recent addition of the Information Assurance and Security (IAS) Knowledge Area (KA) to the ACM/IEEE draft Computer Science Curricula 2013 indicates the importance of preparing computer science graduates to design and implement secure software. We have identified material in the Information Assurance and Security/Defensive Programming KA that can easily be taught to beginning programmers. In this paper, we recommended secure coding topics based on our experience in teaching secure coding in CS0/CS1 courses. We discussed how these topics can be mapped to IAS Knowledge Areas, as well as the unique challenges of teaching secure coding to beginning programmers. We also point out some behaviors of beginning programmers leading to insecure programs that may need the instructor's attention. The information reported in this paper will help other computer science educators to incorporate secure coding into their CS0/CS1 courses. Our future work includes designing more assessment tools to evaluate beginning programmer's learning of secure coding.

Though many Information Assurance (IA) educators agree that hands-on exercises and case studies improve student learning, hands-on exercises and case studies are not widely adopted due to the time needed to develop them and integrate them into curriculum. Under the support of National Science Foundation (NSF) Scholarship for Service program, we implemented two faculty development workshops to disseminate effective hands-on exercises and case studies developed through multiple previous and ongoing grants, and to develop faculty expertise in IA. This paper reports our experience of holding the faculty summer workshops on teaching information assurance through case studies and hands-on experiences. The topics presented at the workshops are briefly described and the evaluation results of the workshops are discussed. The workshops provided a valuable opportunity for IA educators to connect with each other and form collaboration in teaching and research in IA.

Cloud computing (CC) is emerging as a promising solution to businesses and individual users. In order to effectively teach knowledge of CC we have developed three course modules, one education tool, and one real world project. These modules have been successfully taught in COMP 621 Web Security course in Spring 2011, Spring 2012 and Spring 2013 in the Department of Computer Science at XXXX. Our experience exhibits that teaching these modules helped students not only understand the need of CC, but also gained significant knowledge of CC and security architecture. Through a laboratory exercise and a real world project students gained hands-on experience. Students’ survey and feedback reflected that these modules and the laboratory exercise are very valuable in their educational experience. These modules and hands-on laboratory exercise could be used in software engineering, networking, Web security and other first year graduate level courses.

Cloud computing is an emerging technological paradigm that provides a flexible and scalable information technology infrastructure to enable business agility. There are different vulnerabilities in cloud computing and various threats to cloud computing. We have investigated several real-world cases where companies' cloud was infiltrated by attacks. In this paper several types of attacks are discussed, real-world cases are studied, and the solutions that providers developed are presented. Our current research will also be discussed.