Primož Cigoj

Borka Jerman Blažič

An Innovative Approach in Digital Forensic Education and Training

Keywords: digital forensic, training environment, education, cloud computing, forensic tool

This paper present a novel approach to education in the area of digital forensics based on a multi-platform cloud-computer infrastructure and an innovative computer based tool. The paper presents the tool and describe the different levels of college and university education where the tool is introduced. The tool provides multi-level training that is initiated with the educational levels of the exercises and the content applied. The assessment of the achieved results is provided by the tool at the end of the training session.

Introduction

E-learning has now been around for more than 10 years. During this time it has changed from being a radical idea, the effectiveness of which was yet to be proven, to something that is now widely regarded as mainstream in modern education. It is also considered as being the core of numerous business plans and services offered by many colleges and universities [START_REF] Downes | Learning 2.0. The eLearn Magazine[END_REF]. Currently, e-learning tends to take the form of online courses. These courses differ in terms of their technology and content, ranging from the resources distributed by MIT's OpenCourseWare project [START_REF]Open Course Ware project[END_REF] to the design of learning materials offered by colleges and universities from all around the world, acting as the basic unit for the organization of curriculums. The dominant learning technology employed for the management of e-learning is a type of system that organizes, delivers the online courses, and then follows the accomplishments of the learning objectives; it is called the Learning Management System (LMS). This piece of software, which is usually part of the university's network infrastructure, has become almost ubiquitous in most of the known e-learning environments. Other recent technologies, for example, cloud-computing platforms, are not yet being heavily exploited in the area of e-learning training. This is especially the case for education in the area of digital forensic engineering, which is a field associated with cyber security and the fight against cybercrime and cyber terrorism. These fields are very specific and require intelligent, adaptable approaches that respond to user requirements, coming mainly from officers and members of LEAs (law-enforcement agencies), or private investigators, prosecutors and other cybercrime combatants. Criminal justice education, where digital forensic engineering belongs, is still conducted in a very traditional manner, especially when it comes to capturing digital forensic evidence and its subsequent analysis. The training environment for computer forensics and the methods for fighting cybercrime in most traditional institutions are carried out mainly as a static type of training and closely follow traditional matters and approaches in the criminal justice curriculum. The practical exercises and the challenges presented to the students are usually refreshed slowly [START_REF] Pollitt | Virtualization and digital forensics: a research and education agenda[END_REF][4] [START_REF] Taylor | Forensics education: Assessment and measures of excellence[END_REF]. The exercises that accompany the curriculum are mainly carried out in a class studying classic examples. The practical work is focused on solving a task: "find the flag", and the flag to be found is always at the same location as where the training takes place. In a real-life situation, digital investigators are faced with much more complex tasks, where they are forced to use a wide range of methods to solve the problem [START_REF] Hartel | Cyber-crime Science = Crime Science + Information Security[END_REF].

In this paper we describe a novel approach to educating and training in the area of digital forensic engineering. The training is based on the use of a dynamic tool developed within the E-Forensics Educational Community that acts within the D-FET project consortium (Digital Forensic Education and Training project). The tool is installed and offered over the cloud-based infrastructure of the D-FET project [START_REF]D-FET project[END_REF]. Cloud computing introduces an efficient mechanism for a wide range of services that offer real-life environments in the area of cybersecurity and digital forensics, which is not being sufficiently well exploited for on-line education. The cloud-based infrastructure enables the construction of on-dynamic e-learning systems and tools, making this training very close to reality and to real-life situations [START_REF] Laisheng | Cloud Computing a New Business Paradigm for E-learning[END_REF]. The DFET project is funded within the EU's ISEC program [START_REF]ISEC: Prevention and fight against crime[END_REF] and the main objective is the development of an innovative educational approach in the area of digital forensics.

The paper is organized as follows: the next section introduces the cloud-based infrastructure and the basic features of the EduFors tool. The section that follows describes the technical details of the tool and the educational approach applied during the training process. The collected experiences of the performed training and the received feedback are presented in the fourth section, which is followed by a brief discussion and concluding remarks.

The D-FET Cloud-Computing Training Environment

The D-FET project is a training environment that consists of a virtual cloud-based platform that enables the sharing of courses and the use of laboratory training material. The training environment is built up from virtual machines that are generated to an extent that depends on the number of enrolled trainees, meaning that the number of virtual machines is sufficient for the requirements of the training. They can be accessed remotely. The training environment is dynamic and follows the evolving nature of the analytical cybercrime methods and approaches, as well as the technology development of cyberspace. The D-FET training environment caters for a range of educational levels, enabling education for Information and Communications Technology (ICT) students and as well as for law-enforcement professionals. Currently, the cloud infrastructure is owned and shared by the institutions of the participating countries (Slovenia, UK, Ireland, and Sweden).

Figure 1 outlines the generalised training infrastructure and the approach used in creating real-life-based instances of cybercrime attacks or fraud, where an instructor has the possibility to generate an active instance for the training challenge, such as one related to finding data associated with an act of crime on a PC or on a smartphone. These active instances are generally based on known criminal use cases, such as the investigation of a computer for financial fraud, or a denial of service, where an investigation must create an evidence bag and handle the evidence correctly according to the legislative rules, making it intelligible for use in a court. The cloud platform contains an incorporated educational tool known as EduFors, which is designed to provide several cyber forensics images, as instances originating from an attacked operating system or network server.

Fig. 1. The general training infrastructure

Using this tool, multiple instances across the network are created and the challenge presented to the trainee is to collect the evidence from the criminal attack across a number of network-connected devices. The tool then adds the required disk instances for selected scenarios of different types of criminal act and prepares them to be analysed by a digital forensic tool, such as the X-Ways software packet. These forensic analytical tools are stored in the Forensics Media Library built within the DFET project and are triggered for use during the training process. Another key part of the process intended for education and training is the in-built metrics for the assessment of the trainee's performance. These metrics are related to the following:  The time necessary to find the required evidence (which is limited in accordance with some difficulty level that is specified in advance);  The investigation method used;  The application of the right parameters/indicators within the applied forensic tool. The parameters identifying the factual, conceptual, procedural and metacognitive learning outcomes are introduced in the assessment part of the educational tool. Here, we present only the main training process by providing an explanation of the properties of the EduFors tool.

The EduFors Tool

Basic Architecture Description

The tool is designed to generate instances based on known cybercrime scenarios and to present them to the trainee. The required levels of skills and understandings to solve the challenge are accommodated in such a way that it reflects the different educational levels to be employed for the different trainee groups. The EduFors tool consists of two parts: the front end, which communicates (using an API -Application Interface) with the backend, which is responsible for the generation of the instances representing different situations and for the management of the training process. The front end allows the trainees to enrol in the system and to gain access to all the available courses for their level of education. The appointed administrator creates paths for accessing the courses, giving assignments to the trainees and manages the virtual machines generated in different platforms available in the cloud. This part of the system is also responsible for the presentation of the log files, the generation of the images and the injection of standardized templates for each of the crime scenarios that is selected to be examined by the trainee. The tool is also responsible for managing the virtual machines on the remote cloud platforms. Representational State Transfer (REST) access is used (REST over the HTTP protocol) for communications with the remote terminal used by the trainee. The data are exchanged in the JSON format.

The registration of the trainee is enabled by direct self-registration or via a social network account (e.g., Facebook). Adding a new course to the system is fairly straightforward, as just the title and the description of the course are required to be entered, together with the duration of the course, accompanied by the course material. Once the trainees are registered and the courses saved in the system, the administrator starts with the preparation of the virtual forensic machines. Six combinations of cybercrime scenarios are currently available in the EduFors tool, but there are plans to add more. Every time the administrator creates a new virtual machine for each of the existing scenarios, a different dynamic attack is applied to this machine. Figure 2 shows the list of precreated virtual machines and the available crime scenarios, stored on the forensic disks, with the crime-attack data that are afterwards embedded in each template presented to the trainee. The dynamic templates for each type of criminal attack and for each trainee are unique because of the different instances and the injected data.

Each of the criminal attacks is presented to the trainee as a standard template, stored on the virtual machine with the respective forensic disk. The templates presented to the trainee differ in terms of the injected data from the templates presented to another trainee and regarding the required level of skills and knowledge that a particular cybercrime case requires to be solved and for the production of evidence.

Training Scenarios and Assignments

Currently, the EduFors tool generates dynamic forensic templates for the three most frequent cybercrime scenarios: phishing, SQL-based data leakage and a distributed denial-of-service (DDOS) attack. However, in the next version of the tool other cybercrime scenarios will be added according to the definition in the ISO standard [START_REF] Iso | 2012 Information technology -security techniques -guidelines for identification, collection, acquisition, and preservation of digital evidence accessed 2 nd Match[END_REF]. We present all of them briefly, as follows.

Fig. 2. The EduFors forensic virtual machines

Phishing. In this scenario, the client Adam discovers that his bank account has been compromised using a phishing method. The scenario is constructed with the use of two virtual machines (A and C) and a bank server. The attacker has obtained access to the server C by exploiting weak password protection, as he/she has created a fake website as an imitation of the client bank's server. By sending forged emails to Adam, and inviting him to access his bank, the attacker tricks him into believing that he is actually accessing his trusted bank website. That causes the client A to send personal information to the fake host, residing on the attacker server C, and misleading him into believing that he was exchanging information with the bank (server B). The implementation of the phishing scenario and the data capture for forensic analyses require a website that retrieves and stores the entered credentials, the MySQL database for storing the retrieved credentials and various server log files. The log files contain the data of the random accesses to the phishing site by the victims and by the attacker. The instances and the template data are provided by a script, written in PHP language, that uses two parameters -the test name and the test sequence number, for example, "phishing 1". The script then runs the attack scenario by picking up a random date for the time when the attack occurred. A list of template logs is then preloaded from the template folder, which is then used to generate the victim logs in the Apache OS and for the MySQL log files. This script is executed on a special virtual machine that has access to the VMware platform of the cloud and the data storage. The attacker's template is selected and the placeholders are replaced with randomly selected data. These random data are built up from the IP address, the date and the hour of the accesses. The IP address is unique to the whole log and is not repeated for any other victim logs. The populated template, based on these data, is then stored within the output file for the trainee. Each training day can have a random number of events (between 6 and 24). To make the attacker's footprint slightly harder to find by the trainee, additional data lines are added at the top of the log files (adding data for several days up to 10). The same is applied to the end of the log files (for 1 to 10 days). The days are generated incrementally and deincrementally from the remainder of the generated log, so the resulting logs are listed in chronological order. The results are stored in the local MySQL database (the attacker's IP address, the date and the hour of the attack and the type of scenario). A prepared, empty, virtual disk image is copied and mounted as a local file system using the libguestfs tool [START_REF]Diagnostics for libguestfs[END_REF]. The logs are then injected inside the virtual disk image, the virtual machine template is cloned on the VMware server and the modified disk image is uploaded to the data storage. In this way it is possible to enable a new virtual machine to be prepared for inspection of the forensic image. The results, along with the virtualmachine identification, are then returned as an output in the JSON format. The trainee receives a template of Adam's PC and the templates from the compromised server. In this scenario, the assignment given to the trainee consists of the following tasks:  find the IP source address of the attacker,  explain how the attacker has exploited the bank server,  locate the directory where the fake website of the bank is hidden,  explain how the attacker stored the required data for the phishing scenario,  locate the other victims' IP address(es).

The answers to these assignments are then stored, the correctness is checked, and an evaluation is then provided.

Data leakage and SQL exploit. In this scenario, a website is the victim of an SQL injection attack. The attacker has used the search bar to access the website's database. When the administrator of the attacked web server comes to the conclusion that the web data are compromised, he immediately contacts the police. The server is then disabled to prevent any further exploitation by the attackers and the logs are brought to the trainee.

The crime scenario for the data leakage and the SQL exploitation are implemented using the same script as for the phishing scenario, but the task generation is based on different log templates and website structures. The websites are modified so that they become vulnerable to SQL injection, which allows the attacker to run a multi-query MySQL statement, including uploading a binary file and saving it directly within a web-accessible folder. This attack is accomplished with an open-source tool known as SQLMap, which implements the SQL injection method and allows the execution of the remote SQL statements. Several security features of the configured machine for training must be disabled as the most recent OS Ubuntu software versions contain patches that solve the so-far identified security vulnerabilities. We mention some of them here: prevention of writing MySQL data inside the Apache's /var/www/html folder, and removal of the MySQL access to the group www-data, etc. In the Ubuntu OS other security features were also introduced, such as the prevention of the use of the multi-query MySQLi function, which allowed the execution of additional full SQL statements (as opposed to generally used, single-query, MySQLi functions that are not vulnerable to SQL injection attacks).

The file that generates the template data for this type of attack is a PHP script in the form of a web file that allows simpler uploading for larger additional scripts. This scenario uses a publicly accessible PHP shell and a multipurpose script known under the acronym "cyb3r sh3ll". By exploiting these scripts, the attacker can retrieve various types of information from the server database, and each case of access generates a different set of data that is retrieved by the attacker. The script that generates the log files for the trainee uses another type of template. The template matches the specific filenames of the attack scripts and the SQL queries that they execute. As an addition to the MySQL log, the script attaches the SQL injection query that has executed the attack. The assignments for this scenario given to the trainee are as follows:  Decide whether it has come to an SQL injection on the particular identified server;  Identify the IP source address of the attacker;  Find which data were compromised;  Fix the attacked website.

Distributed Denial-Of-Service (DDOS).

A DDOS scenario is implemented using the same script as phishing and data leakage, but the log templates presented to the trainee are different. This attack is implemented by simulating a small-scale DDOS attack that is initiated from different machines. Some of them are just normal computer-machine clients, but the others are virtual. The network traffic for the required evidence is captured on the victim's server. The script for this scenario picks a random date to indicate the date when the attack has occurred. A list of template logs is then preloaded from the template folder to the Apache server log files and presented to the trainee. The assignments given for this type of tasks are as follows:

 Decide whether it has come to a DDOS attack;  Identify the IP source address of the attacker(s);  Find if a botnet network was involved in the attack;  Assess the damage, taking into account the time for which the server was disabled;

The processes run by the EduFors tool during the laboratory training are presented in Figure 3.

The training exercise

Each training includes laboratory work constructed from the assignments generated by the EduFors tool. The assignments are presented to the student as a choice of the available scenarios prepared for a particular educational level and the associated laboratory training. The student selects a one-by-one scenario as a result, and finishes the training after all the task assignments have been solved successfully. After the student finishes the assignment tasks, the educator evaluates the used time and the correctness of the solved forensic problem(s) provided by the EduFors tool.

Fig. 3. EduFors process

The tool collects the following data: the time slot between the opening of an assignment and its closing, and the time the student has used to accomplish the task or to answer the questions. If the time spent for solving the tasks is longer than the pre-allocated time for each task, this is acknowledged to the educator and a negative point is entered into the calculated scores for the correct answers. The allocated time per assignment differs and depends on the difficulty level required for the task solving. If 50% of the answers submitted by the student are correct and the time is not exceeded, then a positive score is given by the tool to this trainee. However, this percentage can be changed by the educator, depending on his/her requirements. To each participant in the training, e.g., trainee, educator and administrator, a different dashboard view of the tool EduFors is provided and this feature allows a visible follow up of the performed tasks and the achieved level of success for each of them.

The EduFors tool was recently launched and used in one of the seminars offered by the MSc program of the International Postgraduate School Jožef Stefan, so exhaustive experience cannot be reported yet. However, the first feedbacks from the educators and the trainees are very positive.

Conclusion

Teaching digital forensics is a demanding area of education as it involves intensive, hands-on exercises that require students to follow potentially tedious procedures that demand a long and focused span of attention. Due to these challenges, current forensics courses are often designed for advanced students that are capable of following a variety of demanding disciplines from OS, IP networking and traffic monitoring, file system analysis, basic web applications or protocols. The knowledge of these disciplines is a prerequisite for digital forensic students, so that they are capable of absorbing advanced, abstract concepts used in discovering acts of cybercrime and frauds. The experiments used for training are usually tedious, static and are not frequently applied during the study. In this paper we have proposed an innovative idea to overcome some of the difficulties associated with digital forensics education, based on a successful combination of the visualization technologies and the dynamic generation instances in a real cloud-based computing environment. The current experiences point to the conclusion that this approach will be very effective in the teaching of digital forensics and in other advanced, computer-based fields that involve an understanding of abstract concepts and hands-on practice. Future work includes upgrading the EduFors tool with game elements that will contribute to the attractiveness of EduFors applications and for triggering more attention from the learners and educators. We also plan to work on a further assessment and evaluation for measuring the effectiveness of the presented educational approach.


Lynette Drevin
email: lynette.drevin@nwu.ac.zagunther.drevin@nwu.ac.za

Günther Drevin

Reflections on the ethical content of the IT honours program project module

Keywords: IT curriculum, Honours project, Research project, Artefact, Information security, Ethics, Social issues, Professional issues, Legal issues, Security awareness

Honours programs in South African universities must include a research project module. There are external pressures from professional bodies and government that influences the nature of the project module. This paper presents a reflection on the process of managing the project module at a South African university taking into account internal and external demands. The focus for this paper is on the ethical content of the projects. Examples of projects are presented after which the ethical awareness of the students is discussed. Not all projects have ethical, legal or social issues, however ethical aspects need to be reflected upon and awareness of these issues is essential during the planning of the project. The awareness that students have on ethical, social and legal issues is investigated in this paper.

Introduction and background

For many years the honours program in IT, that follows after a three-year bachelor's degree in IT, included coursework as well as a practical project. Currently the honours program in IT at the North-West University consists of coursework (8 semester modules) and a project module. A few years ago government prescription demanded changes to the project module. These changes included a higher number of credits as well as changing the nature of the project to have research oriented content [START_REF]The Higher Education Qualifications Framework, Higher Education Act[END_REF]. Currently the number of credits is 32, which implies roughly 320 hours of work for a student during an academic year [START_REF] Taylor | Natural Sciences Project: Computer Science and Information Systems[END_REF].

Recently our institution started a process to get accreditation for the IT program from a professional computer society. In order to align with their requirements another set of demands also surfaced for the project module. One of the main requirements is that the project module must also produce an artefact during the process and not only be a research project. Another demand is the inclusion of legal, social, ethical and professional issues (LSEPI) into the program [START_REF]Legal, social, ethical & professional issues (LSEPI)[END_REF]. With the increased emphasis on ethical issues within organisations as well as government and academic environments this paper explores the topic of ethics and how it is handled in the IT honours project module. The research question for this study of the project module content was: "How aware are students of ethical and related issues when doing their project?"

When reviewing current literature on this topic a leading local university's project module documents were analysed. They indicate a twofold process to obtain permission for a project to progress. A form is completed by the student to get permission to use other students as sources of information (access to students for the purpose of research). The supervisors' details as well as the research proposal are included in this form. This form goes to the director of student affairs. Another form that is needed is the ethical clearance which is submitted to the faculty's ethics committee [START_REF]Guidelines for Honours Projects[END_REF]. Aspects that are covered include:

 Has the student read the university's code where human subjects are involved  Is the student familiar with the procedure of collecting data  Has enough information been given to the participants  Informed consent  Permission to conduct the research where student are involved  Has anonymity and confidentiality been offered to participants  Issues regarding harm to participants or to the university  Any other ethical issues  Can this project lead to publication and subsequent issues regarding authorship Feedback on this process is usually given within a short time in order for the student to make amendments and continue with the project.

From the previous discussion it can be seen that students from this university are guided through the process to reflect on ethical issues and to obtain ethical clearance for their projects. This paper will focus on the university where the project module has recently been changed and will demonstrate how ethics and related topics such as professionalism and social issues are handled within the project module. The layout of this paper is as follows. The research method will be discussed in section 2. Section 3 presents a discussion of how this project module was managed and executed over the past number of years. Example projects will be discussed in section 4. Thereafter it will be shown how the LSEP issues are incorporated into the module by doing a narrative analysis of each project. The focus in section 5 is on the ethical issues that the students have to identify and reflect on. Section 6 concludes this paper with a summary and possible future work.

The main approach to make sense of the project module was to analyse each project in terms of certain factors such as key words used, having a definite Information security content or not, ethical dilemmas identified and reflection of the student and supervisor on the product and process. This paper, however, only focuses on the ethical content to align with the aims and scope of WISE.

The main source of data was the project documentation of the students, e.g. project proposals and projects reports. The proposals and reports were qualitative in nature. Therefore an approach of analysis of data was required to explore the content of the relevant parts, presenting the findings and interpreting it in a way that makes sense of the results. An in depth analysis of what was said and communicated by the students was necessary; therefore narrative analysis was the appropriate approach. Narrative analysis refers to a wide variety of approaches within many disciplines and sub disciplines where interviews and qualitative data are concerned. According to Wood and Kroger [START_REF] Wood | Doing Discourse Analysis: Methods for Studying Action in Talk and Text[END_REF] the aim is to get a deeper understanding of the phenomenon under investigation. However, there is more than one way of doing this. Each project has its own questions and aims and therefore the researcher has multiple ways to do narrative analysis and interpretation [START_REF] Clandinin | Handbook of Narrative Inquiry. Mapping a Methodology[END_REF]. In this context the reports of the students are the vessels in which content is held [START_REF] Oates | Researching Information Systems and Computing[END_REF]. Different topics were examined, retrieved and categorized in order to get a deeper understanding of the ethical issues involved in these honours projects. The yes/no answers in the questionnaires were counted and are shown and discussed in section 5. The students were required to elaborate on these answers and these qualitative data in the reports were analysed using a narrative approach. Short interviews with the lecturers who acted as project supervisors were also conducted and their input to the students on ethical issues will also be presented in section 5 along with the students' reflections on these matters.

The following section presents the management of the project module including some of the internal and external requirements.

Project module management

The number of students in the IT honours program is between 30 and 40. Around 9 lecturers have to supervise these projects. Normally the lecturers propose project topics, however sometimes students also suggest topics that have to be in line with the necessary requirements. Previously the honours projects that were done by students differed in content and nature. Some students developed a practical system while other projects had a bigger research component. Since 2011 the government prescription that the project must be a research project changed the way in which students and lecturers approached the project [8]. Until 2013 the project module was not fixed in nature and it was difficult to get uniformity with the evaluation of the projects.

In 2014 the nature of the project was changed yet again due to the prescription of being a research project as well as producing an artefact [START_REF]Legal, social, ethical & professional issues (LSEPI)[END_REF]. The process of managing and supervising the project can be summarized as follows [START_REF] Taylor | Natural Sciences Project: Computer Science and Information Systems[END_REF], [8]:

 The students are given a project module study-guide in which the aim and significance of the project is presented. The manner in which the project is managed is also described, the role of the project supervisors is discussed and teaching, learning strategies and assessment issues are presented. There are guidelines as well as marking schemes for each component of the project.  The students are also referred to the guidelines of the university regarding post-graduate studies, writing reports and referencing.  The aim of this module is highlighted to the students as [8]:

 To enable students to do research, collect and analyse data and write a well-structured report and article of the results, as well as to communicate the research results during a presentation;  To enable students to apply knowledge of various other modules in the development of an artefact and associated documentation.  The time duration of the project is from February to October.  Project assignments: Students are given a choice of topics proposed by the lecturers.  The role of the lecturer is to supervise the process and give guidance.

Weekly consultations are normally held.  An electronic platform is used for the dissemination of information and documents as well as for the submission of completed components of the project.  Some of the lecturers also inform students of various aspects of the module e.g. research methods, system development strategies, writing of articles, etc. There is also a project coordinator that oversees these topics.  Some projects can be done in small groups but each student must individually submit a final report.  Assessment is done on five components:

 Project proposal and planning  Literature study  Artefact, poster and documentation  Full report and article  Presentation For each of these components, dates for completion are given at the beginning of the year. Guidelines and marking sheets are available for each of the components. Both the supervisor as well as a moderator assesses each component of the project. All the lecturers assess the presentations. The students also do a peer-assessment of their fellow students' presentations.  The aspect of ethical, social and legal issues also gets attention. Students are required to do a literature review on ethical issues. As a starting point they are referred to relevant chapters in research methods textbooks. They also have to complete a questionnaire on the relevance of ethical, social and legal issues regarding their own project. In these questionnaires the students have to indicate how they will address these issues in their projects. The questionnaires are included in the project proposal as well as the final report.

Many textbooks specifically aimed at postgraduate students in IT inform students about ethics in the research process [START_REF] Clandinin | Handbook of Narrative Inquiry. Mapping a Methodology[END_REF], [START_REF] Olivier | Information technology research[END_REF]. Olivier [START_REF] Olivier | Information technology research[END_REF] for instance discusses examples of unethical situations in the research milieu and in so doing provides the students with insight of what to be cautious about. The practice of having an ethics committee or review board to evaluate research proposals and ethical clearances is also explained. Another textbook prescribed to the honours projects is Oates [START_REF] Clandinin | Handbook of Narrative Inquiry. Mapping a Methodology[END_REF]. Issues that are highlighted in [START_REF] Clandinin | Handbook of Narrative Inquiry. Mapping a Methodology[END_REF] are:  The rights of participants in a study: e.g. right to withdraw, right to anonymity.  The law and research: e.g. data protection, legal liability when software is developed.  Responsibilities of the researcher: e.g. behave with integrity.

LSEP aspects are also discussed throughout the students' curriculum at different year levels in modules such as programming, system analysis and design, databases, new developments etc. Definitions or broad descriptions of ethics are discussed. An example of a definition of ethics that is used is "A set of principles that guides decision making based on personal values of what is considered right or wrong" [START_REF] Schwalbe | Information technology project management[END_REF].

 The University has a policy on plagiarism. Students must adhere to these guidelines.  As part of the final project report the students have to reflect on what they have learnt while completing this project. As can be seen in the above list ample help was provided to the students regarding time and process management. Regarding ethical issues an effort was made to inform students about ethical and related issues though lectures, references and examples.

The following section describes a few of the projects that were completed during the previous year(s) indicating the variety of project topics.

Project examples

Students can choose from a range of topics for possible projects offered to them at the beginning of the year. These proposals come from the lecturers that have to take on honours projects. These topics originate from their own fields of interest or expertise or research areas. The students select 5 topics in order of their preferences. A committee allocates a topic to each student in such a manner as to assign them, as far as possible, one of their top 3 choices in order for them to be positive towards their topic from the start of their project.

Examples of project topics, with aims or descriptions as well as an indication of possible ethical issues, are [8]:

1. Generating secure passwords through the use of a password generator:

"The goal of this project is to create a password generator that will help users to protect their data and files from unauthorized access and theft, as well as creating a secure "password vault" that will be used to store the generated passwords so that the users do not need to remember all of them. In order to achieve this, the following objectives must be met:  Investigate existing methods for safe storage of passwords.  Conduct a survey to access individuals' awareness on password management.  Develop an application for individuals to securely store their passwords."

Analysis: Yes -noticeable ethical issues.

Automated Computer Trading System Using Price Action To Predict Currency

Movements.

Analysis: Perhaps -not so obvious to detect ethical issues.

Investigation of privacy concerns regarding mobile positioning data:

"The aim of this project is to investigate privacy concerns of mobile positioning technology. In order to accomplish this, the following objectives need to be reached:  Assessment of the privacy issues of mobile positioning technology.  Evaluation of privacy awareness of mobile users.

 Develop an application to monitor access to the mobile user's location, in order to improve user's awareness and understanding of their mobile applications usage of their location data.  Evaluate the usefulness of the application" Analysis: Yes -noticeable ethical issues.

How the programs of the NSA are harming the integrity of the Internet:

Aims:  "To critically evaluate the activities of the NSA and how they harm the integrity of the Internet.  To inform the public about mass surveillance and what they can do to stop it and how they can protect themselves from it.  To identify and critically evaluate the ethical implications of mass surveillance by referring to surveillance and abuse of powers in other countries where mass surveillance is done."

Analysis: Yes -noticeable ethical issues.

The development of an android mobile electronic banking application for elderly people:

"The aim of this project is to do thorough research regarding the specific needs of elderly people, and to develop a mobile banking application that will satisfy this target group's needs, if they want to make use of electronic banking services.

Analysis: Yes -noticeable ethical issues.

6. Social engineering: Why the social engineer succeeds? "Social engineering will be studied as an attack on individuals and organizations to get sensitive or private information. The aim is to analyse and inspect different aspects of a social engineering attack and finally summarize how these different elements contribute to the success of social engineering attacks."

Analysis: Yes -noticeable ethical issues.

7. A group project on game development. Each member in the group did research on a specific aspect of the gaming industry, for example, graphics and software development methodologies. Furthermore, a game was designed and developed by the group as a whole.

Analysis: No -not so obvious to detect ethical issues.

These examples indicate the variety of topics and different fields of interest of supervisors and students. Some project topics have obvious ethical issues while with others such issues only become apparent at later stages.

The next section presents the analysis of the contents of the projects regarding the ethical questionnaire that the students have to complete as part of their project planning as well as their own reflections of these issues.

Analysis and discussion of ethical content

Each student has to complete a questionnaire on ethical issues pertaining to their project topic. This questionnaire was developed from example documents, guidelines from the university and prescriptions from external bodies. 33 project reports were used as data and analysed. The questions that were asked in the questionnaire, which they had to reflect upon and get more information on, are listed in Table 1. 1. In general all the students indicated that they read the sections on ethics in research in the prescribed documents and textbooks. Two students did not include their ethics questionnaire in their proposal or report. (Thus they did not adhere to the mark sheet and requirements of the layout of the required documents). One of these students, however, did include a discussion of the ethical issues of his project in his ethical literature study. 2. 42% of students conducted a survey or used people as a source of data. It was then compulsory to assure the respondents that their data will be used in a confidential way and their privacy will be protected. This was done as can be seen in the fourth question where 19 of the 33 students gave the assurance of confidentiality to their respondents. 3. 11 Students needed special equipment and had to make arrangements for equipment such as Raspberry Pi boards, Apple computers, Lego Mindstorm sets, etc. They had to make sure that they used the equipment in an orderly and secure manner. 4. Further investigation was done into the apparent discrepancy between questions 2 and 4. Although 42% said people are used as data sources and 57.6% indicated confidentiality to data, 18.2% indicated that they did not have to assure confidentially and 18.2% said the question is not applicable. Strictly speaking, these 17 students that said no in question 2 should also have said no in question 4. It seems that there can be confusion of what is applicable or not when people are used as a source of data. This needs to be clarified to students in future. 5. 78.8% of students indicated that no harm could be done to people or the environment when conducting the project. The 4 students that answered yes to this question had to take due care not to let this principle slip. This question relates directly to the content of the code of ethics/conduct of the ACM and BCS [11,[START_REF] Bcs | British Computer Society, Code of conduct for BCS members[END_REF]. 6. 28 students indicated that there would not be any harm to the university while conducting their research project. The 2 yes answers concerned the use of university equipment and software licensing. 7. 21% of student answered yes when asked if there are any other ethical issues regarding their project. These include aspects such as privacy issues in location based applications, moral and psychological implications when developing games, face recognition in home automation applications, commercialization of artefacts e.g. intellectual property rights, etc. They had to discuss this with their supervisors and write a section in their report on how this will be handled. Almost 70% of students did not have any such issues or could not think of any.

Fig. 1. Distribution of students' responses to ethical questionnaire

Figure 1 presents the seven questions and the responses of the students in a bar graph. It can be seen that the last 3 questions have the most "NO" answers. This may indicate that the ethical concerns relating to people, the environment and the university is minimal. It is not zero, therefore, these issues must definitely be reflected upon and ethical awareness of students is thus necessary.

The students had to expand on the ethical and legal issues that applied to their projects. The following indicates some of these reflections:

 Quite a few mobile applications were developed. With this the aspect of location data had to be taken into account as a possible privacy violation.  New technology was used. Permission was needed for its use and due care had to be taken while using the hardware.  The issue of proper licensing of software was also a point to consider. The alternative of using open source software was also suggested.

 When surveys were done, due care had to be taken to ensure confidentiality of data and identity. Respondents gave informed consent and had the option to withdraw from the study if they wanted to do so.  In the games project violence was highlighted as a possible moral or ethical issue and age restriction was proposed as a solution. One of the game project students also included a chapter on ethical issues in her final report.  One project was on the possible damaging effects of mass surveillance. The need of making users aware of these types of actions was highlighted in this project.

The above points demonstrate that students did indeed reflect on social, legal and ethical issues. Table 1 and Figure 1 indicate in how many of the projects these aspects are present.

After interviewing the supervisors and moderators the following aspects came forth:

 Time management is a huge problem! Although deadlines were given, it was postponed with regularity resulting in a chain effect of accumulation of work.  Students need to have adequate prerequisite knowledge.  They need to be enthusiastic about the topic of their project.  The moderators were mostly satisfied with the process where they assessed different components of different projects.

After the analysis of the interviews with supervisors as well as the students' project documentation a concern that emerged was that the supervisors did not reflect deeply on the ethical aspects and they were easily satisfied that the students did it adequately. Another concern was that not all questions were answered. This should not be allowed.

The university under discussion has a very lengthy application document and process for obtaining ethical clearance for research projects. Therefore an abbreviated document was created for this project module. It is recommended that in future the process for obtaining ethical clearance for honours projects be reconsidered and shortened.

Legal, social, ethical and professional aspects within IT are important and students must be equipped to identify these issues and reflect on how to handle this. The way the ethical questionnaires were filled in and discussed indicates that more guidance is necessary from the supervisors.

The research question that was posed in Section 1 was investigated by analysing the narrative content of the students' project documentation. From this analysis it is seen that the students have an adequate sense of ethical and related issues and can approach their work in an ethically responsible manner. However continuous exposure to the importance of LSEP issues remains a challenge in the IT curriculum.

The following section concludes this paper with a summary and some final thoughts.

This paper presented a reflection of the handling of the project module for the IT honours program. The manner in which the project module is currently being managed under internal academic demands, external demands from government as well as accreditation requirements was discussed.

Examples of projects were presented (some with specific Information Security content) indicating the increasing importance of the topic of security awareness and expertise of students completing their studies in IT. It is shown how ethical, legal and social issues are included in the project. Lessons learnt from the process are shared in this paper.

Key aspects that came forth from this study include:  Deeper reflection is needed on ethical aspects by both the students as well as the supervisors. Not all ethical issues are obvious at the beginning of the project;  Proper completing of the questionnaire;  Streamlining the ethical clearance process for the project module;  Continual effort to raise the awareness of these important matters.

For future work reflection of the project process and product is needed and external bodies' input must be evaluated and incorporated into the management of the project module. IT students' awareness, expertise and knowledge regarding ethical issues need to be relevant and processes followed must be adaptable for current and future demands of the industry and related professional IT bodies.

Table 1 .

 1 Responses of students to ethical questionnaire

	Question	YES	NO	N.A.	No
					answer
	1. Did you read the sections on ethics?	31	0	0	2
	2. Do you use people as a source of data?	14	17	0	2
	3. Do you need permission .e.g. equipment?	11	20	0	2
	4. Assured confidentiality for participants?	19	6	6	2
	5. Damage/harm to environment/participants?	4	26	1	2
	6. Risk to institution?	2	28	0	3
	7. Any other ethical issues?	7	23	0	3