Creating Shareable Security Modules

Nance, Kara; Taylor, Blair; Dodge, Ronald; Hay, Brian

doi:10.1007/978-3-642-39377-8_17

Cited by 3 publications

(2 citation statements)

References 4 publications

(1 reference statement)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They are DE-TER [11] and RAVE [13]. They provide a virtual private network which is flexible isolated from the Internet, so they can be used for offensive and defensive exercises.…”

Section: Related Workmentioning

confidence: 99%

Teaching the security mindset with reference monitors

Cappos

Weiss

2014

Proceedings of the 45th ACM Technical Symposium on Computer Science Education

View full text Add to dashboard Cite

One of the central skills in computer security is reasoning about how programs fail. As a result, computer security necessarily involves thinking about the corner cases that arise when software executes. An unfortunate side effect of this is that computer security assignments typically necessitate deep understanding of a topic, such as how the stack is laid out in memory or how web applications interact with databases.This work presents a series of assignments that require very little background knowledge from students, yet provide them with the ability to reason about failures in programs. In this set of assignments, students implement two very simple programs in a high-level language (Python). Students first implement a reference monitor that tries to uphold a security property within a sandbox. For the second portion, the students are provided each others' reference monitors and then write attack code to try to bypass the reference monitors. By leveraging a Python-based sandbox, student code is isolated cleanly, which simplifies development and grading.These assignments have been used in about a dozen classes in a range of environments, including a research university, online classes, and a four year liberal arts school. Student and instructor feedback has been overwhelmingly positive. Furthermore, survey results demonstrate that after a 2-3 week module, 76% of the students who did not understand reference monitors and access control learned these key security concepts.

show abstract

“…They are DE-TER [11] and RAVE [13]. They provide a virtual private network which is flexible isolated from the Internet, so they can be used for offensive and defensive exercises.…”

Section: Related Workmentioning

confidence: 99%

Teaching the security mindset with reference monitors

Cappos

Weiss

2014

Proceedings of the 45th ACM Technical Symposium on Computer Science Education

View full text Add to dashboard Cite

show abstract

“…In [13], the authors emphasized cybersecurity awareness through exercises. They taught the importance of creating robust code in introductory courses and integrated lecture materials that focused on common secure programming issues.…”

Section: Related Workmentioning

confidence: 99%