Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

Mikhail Senatorov
email: mjsenatorov@mephi.ru

Alexandr Tolstoy
email: tolstoy@mephi.ru

Sergei Zapechnikov
email: svzapechnikov@mephi.ru

"Business Continuity and Information Security Maintenance" Masters' Training Program

Keywords: Information Security, Business Continuity, Standard, Model, Curriculum, Bachelor, Master, Specialist, Higher Education, Master's Program

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In current conditions the critical infrastructure companies are faced with the challenges of their activities disruption or interruption. The reasons differ significantly: disruptions in an energy supply and services delivery, dysfunction of the information and telecommunication systems, presence of the information security (IS) threats in their information sphere and intentional actions or errors of their personnel, resignation of their key personnel, as well as fires, floods, man-made disasters etc.

The "business continuity" (BC) term has appeared in the second half of the 90ties. It was used in connection with the uninterrupted operation of a whole company, including first of all its main (key) and auxiliary business processes.

The BC maintenance process is to ensure the restoration of the company's functioning in the event of any unexpected or undesirable incident that could negatively affect the continuity of the critical business functions and their supporting elements, with a threat of losing the entire business.

In the framework of this process it is important for every company to address issues of IS maintenance. Accidentally the best practices experience shows (e.g., ISO/IEC 27002) that IS maintenance serves a common goal of business development and ensuring its continuity, since the information assets protection against various types of the IS threats can minimize the IS risks and maximize ROI (Return On Investment).

The IS management international standards' (27000 series) analysis has allowed to justify the urgency of the BC&ISM training program. Therefore it becomes evident at present that for the success of any business it is necessary to have knowledge in two interconnected areas -BC and IS. Thus the professionals with integrated knowledge, skills and abilities in these areas are in more demand than ever. That is why relevant staffing for the stakeholders is a very actual problem.

Analysis of the training programs, implemented by the various educational institutions of Russia and related to BC and IS, shows that a substantial dissatisfaction of the labor market needs in the professionals of this profile exists. That fact can be explained by the following reasons. Firstly, BC and IS maintenance (BC&ISM) refers to a fairly new area of a professional activity. Secondly, the dynamics of this area is such that the existing Russian educational system with its high inertia lags behind the labor market needs.

The situation is complicated by the fact that the national system of higher education has lack of BC&ISM professionals' comprehensive training. The BC issues are completely absent in the curricula of the existing IS training.

Partial satisfaction of the labor market needs is met at the level of an additional vocational training via implementation mainly of a few improvement courses and certification programs being implemented with an assistance of the BSI, the Disaster Recovery Institute, the BCM Institute etc. [1][2][3].

The article presents the experience of preparing for the implementation and realization of the "Business continuity and information security maintenance" (BC&ISM) Masters' program at the "Information Security of Banking Systems" Department of the National Research Nuclear University MEPhI (NRNU MEPhI, Moscow, Russia).

Choice of Educational Direction for BC&ISM Professional Training

The national system of higher education in Russia includes the following educational levels: 1) Bachelor (4 years' full-time training period, on the basis of the school education); 2) Master (2 years, continuing education after "Bachelor" qualification or the second higher education); 3) Specialist (5-5,5 years, on the basis of the school education).

There are two lists: • a list of the training directions related to the implementation of the various profiles of bachelors and the various programs for masters; • a list of the specialties.

For each training direction and each speciality there is the developed and approved basic national Federal state educational standard (with abbreviation FGOS from the Russian title of the standard) and corresponding approximate (so-called recommended) curriculum.

Taking into account the above-mentioned features of the professional activities related to BC&ISM, it is possible to consider the applicability of a particular level of education for the professionals training.

Firstly, a long-term training on the basis of higher education (bachelors, masters and specialists) cannot provide the required adaptation of the training content to the dynamically changing field of the graduates' professional activity.

Secondly, the strict framework for the training content, set by FGOS for bachelors and specialists, does not allow to take into account adequately the companies specifics under which BC&IS challenges are addressed and where the graduates of the educational institutions will work.

Thirdly, among the training directions and specialities there is no FGOS directly related to BC&ISM.

To our opinion the most appropriate way of addressing this challenge is to select an educational direction related to Masters' training. This approach has the following advantages:

• short training time (only 2 years);

• variability of the curriculum formation (up to 50 % of training time can be given to the subjects, developed by an educational institution itself and directly related to the chosen field of their graduates' professional activity); • flexibility of the curriculum implementation (up to15 % of training time can be given to so-called "optional (selected by the students themselves from the proposed set, at their own choice) disciplines" when the students choose to study the particular subjects, reflecting the specific objects of their professional activity, with which they may work during their further employment); • practical orientation of training (up to 25 % of training time can be given to the different types of practices (practical work), the implementation of their scientific and research works and preparation of a final qualifying work -PhD dissertation); • curriculum adaptability (an educational institution must provide the students with a real opportunity to participate in their training program development themselves, including possible development of their individual educational programs). The outlined above features enable to make a reasonable choice of the level of higher education "Master" as a base for the BC&ISM professionals' training.

The Master's program development involves its binding to a specific educational direction. BC management in the presence of the IS threats in the information sphere relates directly to IS management. Therefore it is expedient to choose the 090900 "Information Security" educational direction and the corresponding FGOS [4].

Model of a Graduate Trained on BC&ISM Master's Program

The model of a Master, trained on the BC&ISM program, should define the areas, objects and types of a graduate professional activity and also the professional tasks, which he/she can solve in a company, where he/she will work after graduation.

The modern Russian education is based on the so-called competence approach: the training outcome is stated as a list of the professional competencies that a student must acquire and that will determine its ability to apply his/her knowledge, skills and personal qualities to be successful in a particular area. Therefore the model should be supplemented by the appropriate professional competencies.

It should be noted that FGOS [4] contains the definition of the areas, objects and types of the professional activities, and also the professional tasks and the corresponding professional competencies related to basic IS Masters' training. These definitions were taken as a basis for describing the Master's model, adjusting them to a specific subject area of BC&ISM.

The professional activity's area for the BC&ISM Master's program graduates is the following: the areas of science, engineering and technology, covering the wide range of problems related to ensuring BC&IS of the key company's business processes in conditions of presence of the IS threats in the information sphere.

The professional activity's object for the BC&ISM Master's program graduates are the following:

• information resources and IT; computer, automation, telecommunication, information and analytical systems that ensure the key company's business processes; • technologies ensuring BC&IS of the key company's business processes;

• methods and tools for designing, modeling and experimental testing of systems, ensuring BC&IS of the key company's business processes; • management processes for ensuring BC&IS of the key company's business processes.

The professional activity's types for the BC&ISM Master's program graduates are the following: • organizational and managerial;

• design; • control and analytical; • scientific and research;

• scientific and pedagogical.

The professional activity's types are related directly to a particular company's activities. At present the following companies' types that may need the BC&ISM professionals can be outlined:

1) companies that create and operate systems ensuring BC&IS of their business processes (such as banks); 2) companies developing such a systems (for example, system integrators); 3) companies engaged in control for assessing BC&ISM level of the key company's business processes (for example, auditors); 4) companies carrying out scientific research and providing education (such as scientific and research centers and educational institutions).

The professional activity's tasks for the BC&ISM Master's program graduates are the following:

1). BC&ISM systems' creation and operation relate to an organizational and managerial activity. Company's personnel are involved in addressing the following professional activity's tasks:

• participation in the projects on creating the BC&ISM systems for the key company's business processes; • preparing some methodical and legal documents' drafts, proposals and activity for the BC&ISM systems for the key company's business processes; • organization and implementation of a control activity for effectiveness assessment of the BC&ISM systems for the key company's business processes; • organization of an activity on improvement, modernization and unification of the BC&ISM systems for the key company's business processes in compliance with the legal documents and requirements. 2). The BC&ISM system for the business processes development relates to a design activity of the company's personnel and includes addressing the following professional activity's tasks:

• system analysis of an application area, identification of the IS threats and vulnerabilities in the company's information systems, development of the BC&ISM requirements and criteria for the key company's business processes; • conceptual design of the complicated systems, tool sets and technologies for BC&ISM for the key company's business processes; • justification of a choice of the functional structure, organizational principles for hardware, software and information management of the systems, tools and technologies for BC&ISM for the key company's business processes; • development of the BC&ISM systems and technologies for the key company's business processes; • adapting of the modern BC&ISM techniques for the key company's business processes to a particular company on the basis of the domestic and international standards. 3). Implementation of the control functions on an assessment of the BC&ISM level for the key company's business processes is related to a control and analytical activity, addressing the following professional activity's tasks:

• development of the control and analysis activity's programs;

• effectiveness control of the measures being used for BC&ISM of the key company's business processes; • implementation of the auditing programs for BC&ISM of the key company's business processes; • composing of a control and analytical activity's documentation. 4). In carrying out the scientific research and educational activities the universal tasks listed in FGOS are addressed [4].

The BC&ISM Master's program is aimed at developing the graduates' specific professional competencies. At the end of the training they should be able:

• to analyze and explore the BC&ISM models and systems; • to use in practice the BC&ISM standards;

• to analyze the IS risks in order to ensure BC;

• to conduct synthesis and analysis of the design decisions on a company's BC&ISM; • to ensure the effective application of a company's information and technology resources to meet the BC&ISM requirements; • to participate in design and operation of a company's IS incident management;

• to participate in design and operation of a company's BC&ISM systems;

• to conduct an instrumental IS monitoring in a company;

• to develop the proposals for a company's BC&ISM systems;

• to develop and effectively implement a complex of the BC&ISM measures (including rules, procedures, practical techniques, methods, guidelines, tools). These professional competencies are established during a particular curriculum implementation.

BC&ISM Master's Program Curriculum

The BC&ISM Master's program curriculum (Table 1) has been created in 2011. It is a list of the disciplines with their labor content in credits and academic hours. All the disciplines are grouped in two training cycles:

• M1 -general scientific; • M2 -professional.
Each training cycle has a basic part with a list of the disciplines determined by FGOS [4] and a variable part with the disciplines, identified by each educational institution itself and reflect the features of a particular Master's program.

The successful development of the professional competencies during the BC&ISM Masters' training is impossible apart from the specific objects. Therefore in each variable part there are some optional disciplines, reflecting the specifics of such an objects. In the given curriculum (Table 1) each optional discipline matches two disciplines related to the Russian credit and financial sector (e.g. banks) and to the Russian nuclear industry (corresponding to the specifics of the NRNU MEPhI).

During training within each optional discipline a student studies one of these disciplines considering a company's specifics, in which he/she will work after the graduation.

With the development of the Master's program the number of the disciplines related to a specific optional discipline can be increased, thereby extending the range of the professional activity's objects.

The curriculum has another two cycles that determine the time required and the labor content of the practice (internship), scientific research works (M3) and final state certification (M4). This part of the curriculum involves the students into implementation of some specific projects related to the BC&ISM systems of a particular company's business processes.

This allows to create graduates' practical skills to apply the existing regulatory framework, to implement the IS risks (related to disasters) analysis, to establish the proper criteria for evaluating the possibility of an IS incident transformation into a disaster, to determine the IS related disaster scenarios, to choose the strategies and

Conclusion

The IS management international standards' analysis has allowed to justify the urgency of the BC&ISM training program. The experience of preparing for BC&ISM program implementation and realization at the "Information Security of Banking Systems" Department of the NRNU MEPhI shows that this program is more suitable to implement for Masters. Justification of the educational direction choice for the BC&ISM professionals is given.

The BC&ISM Master's program is designed for the applicants with the "Bachelor" qualification (for continuation of their higher professional education) or "Specialist" qualification (for the second higher education).

The model of IS Master being trained on this program is described. The model defines the areas, objects, types and tasks of a graduate professional activity.

The presented curriculum has been launched in the NRNU MEPhI from 2012. The first group of Masters (15 students) has started their training from fall 2012 and they still have not finished their first year.

Our findings may be useful for the tutors and managers of the similar training programs.

tools to ensure IS during the disaster and to develop the coordinated BC&ISM programs.


Dino Schweitzer

David Gibson

David Bibighaus

Jeff Boleng

Preparing our Undergraduates to Enter a Cyber World

Keywords:

Today's students have grown up with computer-based technology and need to be prepared to enter a career in a digital world. This includes an understanding of the broader implications of technology such as the growing threat of cyber-crime and cyber-terrorism, cyber-ethics, the legal and social implications of technology, and the local and global impacts. At our institution, we have taken a broad look at ways of integrating cyber awareness and education across the curriculum to reach all levels of students, irrespective of their major. We have identified core cyber issues that are taught to all freshmen, developed awareness training that is regularly completed, provided opportunities for interested students to gain more cyber knowledge through a student club and summer program, and developed an in-depth educational program for technical students to graduate with an emphasis in cyber-warfare. This paper will describe our various cyber programs and future plans.

Introduction

A key priority in the National Strategy to Secure Cyberspace is to increase security training and awareness through enhanced education programs [START_REF]Critical Infrastructure Protection Board, National strategy to secure cyberspace[END_REF]. As a result of this emphasis on security education, more courses and programs are being offered at the undergraduate level in security-related topics such as cryptography, information security, network security, and information warfare. These courses have benefited from an increasing number of textbooks, curriculum development, and student competitions such as the Collegiate Cyber Defense Competition [START_REF] Conklin | The Use of a Collegiate Cyber Defense Competition in Information Security Education[END_REF].

While much of the focus of cyber education has been on the creation of a professional cyber workforce, at the United States Air Force Academy (USAFA), we feel it is critical for all students to have awareness of the issues and threats associated with cyberspace. In addition, students who have a strong interest in cyber topics, but are not technical majors, should have the opportunity to explore cyber-related areas in greater detail without taking highly technical computer science or engineering courses. Finally, our students who will be starting their careers as cyber professionals need to be able to explore, in depth, both the conceptual aspects of cyberspace as well as receiving hands-on experience in the tools and techniques of the field. This paper will examine these three levels of cyber education and training as implemented at USAFA.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Cyber for All

While many recognize the importance of developing the cyber skills of all students, finding a place in the curriculum for cyber education and training can be a challenge.

At USAFA, all students receive cyber education in the core curriculum and cyber training in their First Year Experience course.

A large core curriculum at our school provides an ideal opportunity for cyber education in the Introduction to Computing (CS110) course offered by the Computer Science department and taken by all students as freshman. CS110 consists of 40 lessons covering information representation (5 lessons), algorithmic reasoning (13 lessons), computer system capabilities (7 lessons), computer ethics (1 lesson), software applications (7 lessons), cyber security and warfare (5 lessons), plus a midterm exam and course review (2 lessons). While cyber security topics naturally arise in discussions throughout the course, the 5-lesson cyber security and warfare block is dedicated to cyber education. CS110's five cyber block topics are: information security, cryptography, cyber warfare and crime, offensive cyber operations, and defensive cyber operations. In addition to introducing the growing importance of cyber security and the prospect of cyber warfare, the information security lesson focuses on the principles of confidentiality, data integrity, availability, and authenticity. The cryptography lesson introduces students to basic symmetric encryption techniques as well as asymmetric public key encryption and digital signatures. CS110's cyber warfare and crime lesson provides students with a political, economic, and military context for cyber warfare and cyber crime before discussing current threats, vulnerabilities, and common cyber attack vectors. The offensive cyber operations lesson explains to students how individuals and organizations conduct cyber attacks with a focus on password attacks and attacks using social engineering. Students do not learn about specific cyber attack tools and techniques in CS110. Finally, the defensive cyber operations lesson focuses on strategies for defending against the attacks described in the previous lesson with a focus on how students can protect themselves and their own computers.

All of our students also learn about cyber topics in several other required core courses. For example, in Principles of Air Force Electronic Systems offered by the Electrical and Computer Engineering department, all students learn about circuit and packet switching networks and their respective vulnerabilities to cyber attacks. In Military Theory and Strategy, offered by the Military Strategic Studies department, students learn about military cyber capabilities and strategies. In General Physics II, students learn about the electromagnetic spectrum which underlies all cyber technologies.

Few colleges and universities have a large core curriculum like USAFA's. Nevertheless, opportunities exist at many schools for introducing cyber topics to a broad group of students in general education elective courses. One target of opportunity may be the first year experience course required for all freshmen at many schools. At USAFA, one of the first lessons of the First Year Experience class teaches cadets how to access and use the institution's computer network safely and securely.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Cyber Training

In addition to the exposure to cyber topics provided all students in the core curriculum, our department has created opportunities for greater hands-on cyber training to interested students outside of the classroom. We accomplish this through two primary mechanisms: a summer cyber training program and an active Cyber Warfare Club.

Basic Cyber Training

This summer, we will offer our newest training course in Cyber Warfare -Basic Cyber (Cyber 256) which was first prototyped in the summer of 2009. The course is a ten-day introduction to cyber operations and is open to all sophomores. The goal of the class is to "explore … cyber … with hands-on training designed to teach the fundamentals of establishing, operating, attacking, defending, and exploiting computers and networks." The course was modeled on our USAFA's basic sailplane course. There are three distinctive aspects of the basic sailplane course that we are incorporating into the Cyber 256:

• Light on Theory -heavy skills training. In soaring, students receive very little classroom learning (just enough to keep them safe) and spend most of their time in the cockpit. The goal is to provide enough real-world exposure early in their experience with the subject to allow students to intelligently decide if they are motivated to delve deeper into the subject (which will naturally require a more in-depth classroom experience). Likewise, our cyber class is designed to give them enough hands-on training with real world tools in a carefully controlled environment to allow them to decide if they want to pursue the discipline at a deeper level. • Student Led -One of the amazing things at our institution is to watch the hundreds of glider flights that occur safely every week and realize that they are being taught by undergraduate instructors. This has two benefits: for the student, it makes the skills seem not so far "out of reach" and removes some of the mental limitations that students often place on themselves. For the student instructor, it not only builds a deeper level of competency in the subject area, but also develops the ability to lead and communicate effectively about their discipline. Since cyber warfare is often perceived as a dark art, having students lead the training is important to make the topics appear more accessible to the students. In addition, the nation needs young men and women who can effectively communicate and lead in cyber matters. • Task Oriented -The soaring program is centered on students being able to perform a series of tasks needed to safely and effectively fly an aircraft. For the Cyber course, students will be presented with a series of scenarios that require them to perform specific tasks and will be evaluated on whether or not the student performed them satisfactorily.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

The Cyber 256 class will expose students to cyber-warfare primarily from an attacker's point of view. Students will begin by exploring some of the basics of establishing a network and then quickly proceed to use some of the more commonly used network security tools. The idea is not to provide in-depth training on these tools, but rather provide enough exposure for the students to understand the basic process and appreciate some of the avenues of attack. In addition, the course is designed to be cross-disciplinary. Special emphasis is placed on the larger context of cyber warfare including social engineering, the legal aspects of cyber warfare, current threats, and how the Air Force is organizing itself to address them. Table 1 shows a list of the topics taught during the Basic Cyber Warfare course. The Cyber 256 course has some similarities to the Advanced Couse in Engineering Cyber Security Boot Camp (ACE) course that was developed by the Air Force Research Laboratory and administered to Air Force ROTC students [START_REF] Jabbour | The Advanced Course in Engineering on Cyber Security: A Learning Community for Developing Cyber-security Leaders[END_REF]. Our course has several important differences. First the course is offered to all rising sophomores. This is one year earlier than the ROTC program and therefore cannot be limited to students of a particular major. In addition, it is a ten-day course as opposed to the current ten weeks for ACE. Because of the compressed timeline and less-restrictive pre-requisites, the course is, by design, much more training-focused as opposed to education-focused.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Cyber Warfare Club

The Cyber Warfare Club at USAFA was created as a multidisciplinary club with members from all academic majors. It is similar to the club described at the United States Military Academy [START_REF] Conti | A Comprehensive Undergraduate Information Assurance Program. Security education and critical infrastructures[END_REF]. Among the current 100+ club members, there is a diversity of academic majors, to include aerospace engineering, biology, chemistry, computer science, economics, electrical engineering, English, military strategic studies, physics, political science, space operations, and systems engineering. One of the goals of the club is to make it inclusive and attract a diversity of students. This decision was based on the realization of the importance of cyber education to all of our graduates.

In September of 2008, we began to survey the interest of students at our institution in cyber warfare by demonstrating some simple Backtrack tools at semi-annual majors nights where we typically recruit young students into the computer science major. The response was overwhelming. Several planning meetings were held with many of the interested students leading to a vote for student leadership in January of 2009. The club was officially recognized by the institution club regulatory body at the end of March the same year. In the short history of the club, we have had many successful training opportunities, invited talks, and members have participated in several competitions learning a great deal along the way.

We have had to carefully design club activities to ensure opportunities for all members because of the diverse nature of our membership. One way in which we have done this is through talks given by experts from the field. One of our first talks was given by the Director of Communications and Information at our institution and detailed a plan for the future network architecture. Since that first talk we have had others including a presentation on current trends in cyber warfare by the Research Director at Gartner, threats and case studies by the NSA Information Assurance Directorate Technical Director, and Public Key Infrastructure by the Air Force PKI Team. Recent talks include a discussion of Microsoft's work to mitigate threats by a senior Microsoft Security specialist and a discussion of the policy, law, and ethics of cyber attack by the Chief Scientist of the Computer Science and Telecommunications Board, National Academy of Sciences. By providing a mixture of technical and policy discussions we have been able to entice a mixture of all of club members to attend and participate.

Hands-on training in network attack and defense is another major goal of the Cyber Warfare Club. Development of the appropriate level of hands-on labs has been challenging. One of the approaches we have used is to introduce security concepts through web-based simulations of cyber threats such as buffer overflow and SQL injection which do not require a highly technical background to understand [START_REF] Schweitzer | Designing Web Labs for Teaching Security Concepts[END_REF]. We identified the following topics as a starting point for hands-on lab development:

• vulnerability analysis and penetration testing,

• the hacker methodology,

• incident response,

• forensics,

• reverse engineering,

• networking fundamentals, and Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

• service fundamentals A key concept in our hands-on labs is the idea of a "check ride". In aviation, a check ride is where a student takes control of a plane (under the close supervision of a qualified pilot) and demonstrates techniques and is either verified as being qualified or needing additional training. We utilize our senior club members to provide cyber check rides to the more junior students. We are pursuing the development of multiple training modules in parallel. Additionally, there are several opportunities to leverage work being done in various cyber organizations to provide additional training to club members. Several organizations have expressed an interest in collecting club materials and training modules developed at our institution.

Besides the training opportunities, we have used the club as an opportunity to select students for additional training provided commercially. Over spring break in 2009 and 2010, we sent ten students to Certified Ethical Hacker training. This course was well received by the students.

In its short history, students from our Cyber Warfare Club have participated in multiple cyber competitions. Two of these competitions had the students on blue teams protecting systems and services while another allowed them experience on a red team in a capture the flag event. We recently competed in the 2010 International Capture The Flag (ICTF) competition and had a respectable placing in the top 20 of all teams worldwide [START_REF]The UCSB iCTF[END_REF]. These competitions serve as capstone events and tie all of the education and hands-on training together to provide students an opportunity to integrate all their skills and get a feel for the bigger picture.

Cyber in Depth

Along with the cyber education given to all students, and the cyber training providing additional experience to interested students, we offer students the opportunity to explore cyber topics in much greater depth through the cyber warfare track of our computer science major, through the cyber instructor course, and through cyber research opportunities.

Cyber Warfare Track

Our Computer Science major has been recognized by NSA and DHS as a Center of Academic Excellence (CAE) in Information Assurance Education. We have integrated computer security principles in several of our major courses where appropriate. In addition, all CS majors are required to take the Information Warfare course which is a concepts course in cyber security.

For students that want to focus on cyber warfare, we offer two additional courses, a cryptography course and a network defense course. Students that complete both of these as optional courses in the major receive a designation on their diploma as having completed the cyber warfare track of the Computer Science major.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Cyber Instructor Course

As stated earlier, undergraduate students are the primary instructors of the Cyber 256 class. Each 10-day offering will have fifteen students and three undergraduate instructors. These student instructors have been hand-picked by the faculty because of their leadership potential and demonstrated proficiency in the cyber warfare club.

As previously described, this instructor model draws heavily from the sailplane instructor paradigm. For each skill, student instructors will demonstrate a skill, allow students to practice the skill with instructor help and finally have the student perform the skill for evaluation. If the sailplane program is any indication, the biggest challenge for these instructors will be to restrain themselves from correcting student mistakes too quickly. The Cyber Instructor Course fulfills a very important and often underappreciated need within the cyber warfare discipline, namely to develop cyber leaders. Too often cyber warfare courses emphasize the technical nature of the discipline. Yet what is in demand are people who not only understand the technical challenges cyber warfare presents, but can communicate those challenges to non-technical people. Student instructors will be required to train their non-technical peers to use sophisticated cyber security tools to perform basic tasks. In the process, they will develop both their technical and leadership skills. In fact, USAFA is allowing these cyber instructors to teach the cyber warfare class in-lieu of other leadership requirements.

Cyber Research

Although we are an undergraduate-only institution, we believe that research is an integral part of the undergraduate experience. Students have the opportunity to explore a cyber-research topic in-depth through an independent study course which matches the student with a faculty mentor conducting research on a specific project. In addition, our institution offers a 5-week summer research program made available to the top students in each major. Between their junior and senior years, students in this program attend institutions such as NSA, NRO, MITRE, Intel, and research organizations to work on a real-world research problem. The program is highly rated by students and gives them an excellent exposure to the cyber world outside of academia.

We believe that research should not be relegated to just the top students. In our Information Warfare course required of all computer science majors, we have created a final course project that provides a research experience [START_REF] Schweitzer | Providing an Undergraduate Research Experience in a Senior Level Security Course[END_REF]. Students pair up with a faculty mentor to work on a current research topic throughout the semester. The project is broken into the phases of a research effort where students have to conduct background investigation, develop a research plan, collect data, perform analysis, and document their findings in both a research poster and a conference-level research paper. Several of the projects have been published in various conference proceedings.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Future Plans

Our current program is successful in providing all of our graduates a fundamental exposure to important issues they will be facing in their professional careers.

Students with an increased level of interest have access to training opportunities that take into consideration the fact that they may not be technical majors. Our graduating cyber professionals have a high rate of accomplishment in their careers and a proven track record of successful performance.

To continue our success, however, requires evolving our program as technology changes and as the demands of our students future career field change. We are constantly updating our educational cyber curriculum and have faculty actively involved in cyber-education working groups. We also have faculty who actively participate in defining training standards and programs for the Air Force cyber career field. We try to take the lessons learned to improve our cyber training opportunities for students. As we gain more experience with Cyber 256 and the associated student instructors, we will need to tweak the program to keep it fresh, challenging, and relevant. Similarly, we are constantly in touch with our peers in the commercial and research sectors to understand the current challenges and find interesting projects for our students to work on. By maintaining currency, we hope to keep our broad-based program at the forefront of cyber education and best prepare our students to enter the cyber world.

Table 1 .

 1 Topics in Cyber 256.

		Morning Topic	Afternoon Topic
	Day 1: Establish	Basic Network Training	Advanced Networks
	Day 2: Cyber Intel	Network Mapping	Denial of Service
	Day 3: Penetrate	Computer Penetration	Web Vulnerabilities
	Day 4: Operations	Air Force Cyber Mission	Cyber Threat
	Day 5: Social Aspect	Social Engineering	Law
	Day 6: Wireless	Wireless Vulnerabilities	Password Cracking
	Day 7: No Training
	Day 8: Forensics	Forensic Tools	Hard Drive Analysis
	Day 9: Advanced Threats	Root Kits	Intrusion Detection
	Day 10: Capstone	Capstone Part I	Capstone Part II


Yanzhen Qu
email: yqu@coloradotech.edu

How to Secure the Cloud based Enterprise Information System -A Case Study on Security Education as the Critical Foundation for a MS-EIS Program

Keywords: Enterprise Information System, Security, Security Education, Cloud Computing, Service Oriented Architecture

This paper presents a case study for a new Master of Science in Enterprise Information Systems program created at Colorado Technical University in which security courses occupy over 20% of all classes within the program. Should there be such a high emphasis on security courses? Through reviewing the performance of the first class of students in the Enterprise Information System Capstone course of this program, we can conclude that the investment on the security education is absolutely necessary. These courses have laid down the critical foundation for students to correctly handle today's ever growing real world Enterprise Information Systems' challenges.

Introduction

As Enterprise Information System (EIS) becomes an integral part of any modern business, the need to train more qualified IT professionals who can take a business problem and find an EIS solution to address business requirements of the enterprise has become more urgent. To Among all fourteen courses, three courses are related to security. Obviously the security is the heaviest emphasis in this new program. This results from the combination of the market trend research and the recommendation from the CTU's industrial advisory board. Because security issues are associated with every component of the EIS, every application, and every business process, it is no longer enough to just provide students with some basic concepts and common practice knowledge in security management. It is very important to make students understand the root cause of all the security issues, the essence, principles and methods of security management, and the impact of security to every decision made by an EIS designer or developer. In fact, as a "National Center of Academic Excellence in Information Systems Security Education" designated by the US National Security Agency and the Department of Homeland Security, CTU has always placed a high emphasis on security education in its Computer Science and Information Technology degree programs in all levels from Associate, Bachelor, and Master to Doctor.

In January 2010, the first cohort of students enrolled in this new program was about to take their EIS Capstone course. The students were to be tested on how well they could solve real world problems by applying the knowledge and skills they had acquired from the new program. At the same time this new program was also to be tested on how effective its courses were. Having taught several courses with this cohort, recommended by both the school and the students, I was selected as the instructor for this first EIS Capstone course.

In the following sections I will present a case study of the EIS Capstone course so that we will have some evidence to answer the question: "Is the emphasis on security in this new program a right decision?" Interestingly enough, the answer to that question is closely related to the answer to another more technical question: "How to secure the Cloud based Enterprise Information System".

The rest of this paper will help relate those two questions. Computing [START_REF] Linthicum | Cloud Computing and SOA Convergence in Your Enterprise[END_REF], [START_REF] Mather | Cloud Security and Privacy Enterprise[END_REF]. During the second week of the class, our sponsor met with all the students, and issued a written task specification as shown below (minor wording modifications have been made correspondingly) [START_REF] Qu | Internal Communication Note[END_REF]:

"The Information Technology (IT) department serves the global technology infrastructure needs of the Company through the stewardship of scarce financial, human, software and machine resources. The Company has set as its goal to double its service to the targeted customers by the year 2015 and double again by the year 2020. In anticipation of supporting this goal, IT will complete installation of a global technology infrastructure upgrade by June 2010. In addition to internal Company's resources, IT envisions leveraging an agile global pool of technical resources to assist in the construction and deployment of our technical service offerings. Service offering outcomes may include technologies that link suppliers to customers, address specific community needs, and enable real time responses from venders or suppliers to global needs.

Task Description:

In consideration of Vision 2020, global technology infrastructure upgrade, the current IT architectural and investments, will establish an executive level plan to establish a global developer network that:

• Articulates a global vision, outcomes and benefits • Describes the objectives and scope of the plan • Frames and describes the required technical infrastructure, standards and processes required • Outlines the sequence of proposed activities and dependencies • Documents risks and mitigation strategies • Provide a rough order of magnitude costs to implement • List assumptions that bound the scope and delivery of the project " After reading through this task specification, all students asked the same question: "What are the real requirements?" This was because they were lacking the working knowledge regarding the Company's As-Is IT systems, the daily real challenges and restrictions that the Company's IT department faced, and the root cause of these problems. Therefore, the students decided that they first needed to start the system life cycle development process to make more in-depth investigations, and to exercise more due diligence to find out the real requirements.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland Through a sequence of email communications and several face to face meetings, much more information was collected, as summarized in the following:

• The Company was helping more than 1 million customers in 25 countries with an ever growing need. It was essential that the Company expands its systemwide IT communication capability to automatically translate, store, secure, update, and rapidly retrieve large amounts of data. • The protection of the Company's business databases which include the financial information of their partners, vendors, suppliers, and customers, was a crucial requirement.

• The Company's existing IT systems were developed by multiple vendors and introduced at different times for different purposes. The Company's As-Is IT systems were really the Silos systems as described in [START_REF] Goyal | Enterprise Grid Computing with Oracle[END_REF]. All the IT functions had been independently structured to meet local application demands with only a secondary consideration on how to connect a global community. The IT functions also did not readily share information outside of their respective infrastructures.

• With the limited IT budget that the Company could offer, developing any new integrated EIS would require a very innovative and non-conventional solution.

And the Company was willing to look into any new technical solutions that could save costs while still achieving its' final goals.

It was very clear that the real requirements could be concluded in one statement:

"The Company needs to develop a Service Integration Architecture Framework to enable existing and new functionalities and resources continuously integrated in a fast, secure and cost efficient manner."

This statement was quickly reviewed and endorsed by the sponsor. It then not only provided the project direction for students, but also became the only criteria to assess the final result of the students' work created through the project.

A Solution Meeting the Requirements: Service Integration Architecture Framework based on Cloud Computing [6]

After fully understanding what the real problems of the As-Is IT systems were and what real needs the Company had, the students quickly focused their effort onto creating a new Service Integration Architecture Framework (SIAF). The SIAF would help the Company not only to move from the Silos systems to an integrated Service Oriented Architecture (SOA) based system, but also to take advantage of Cloud Computing Services wherever appropriate.

As shown in Fig. 1, the proposed SIAF addressed the pre-requisite considerations and risks associated with external Cloud Computing Services and/or platforms to include newly evolving issues, constraints, efforts, technical advances, and the latest industry standards pertains to the Company's global operations.

In the proposed SIAF, the discussions were focused on the following five aspects:

(

Pros and Cons of Cloud Computing Services

The students provided a through analysis on the Pros and Cons of various types of Cloud Computing Services regarding the needs of the Company, as summarized in the Table 1.

The students concluded that although public Cloud Computing Services could provide cost savings on both IT Application and Data Management, the cost to maintain the required security and privacy as well as data accessibility would reduce that benefit. The entire IT Operation cost would only be reduced to a certain level depending on what type of Clouding Computing Service was really used.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Security in the Context of Cloud Computing

Security functionality is the central part of in this SIAF. It is managed through two subsystems: Identity and Access Management (IAM) subsystem and the Data Security subsystem.

IAM Subsystem

The IAM subsystem includes the following components:

• Access control based on business requirements The IAM's purpose in the context of the Cloud Computing is to extend and blur the lines of boundary and trust. It must achieve the following security functionalities:

• Timely and secure managing of on-boarding and off-boarding users in the cloud. • Authenticating users in trustworthy and manageable manner and addressing credential management, delegation, and managing trust across multiple types of Cloud Computing Services. • Federation to enable organizations to use selected Identity provider (IdP) to exchange identity attributes across allied organizations. • Authorization and user profile management to establish and manage profiles and policies to control access in auditable manner.

Data Security Subsystem

In addition to the conventional data security functions that are usually associated with the specific data management systems (such as databases, or data warehouses) in the context of Cloud Computing, the data security subsystem must also support the following functionalities:

• Arranging different data stores and accessing measures based on the security level, availability and integrity requirement of the data. application's lifecycle such as "application development mode", "application testing mode", "application operation mode", "application maintenance mode", and "application retiring mode", etc.

Communication, API and Business Process Manager

The Internal ESB is responsible for managing and interacting with the Company's current information at its Core IT Infrastructure. For example, the Internal ESB can manage and increase capability to communicate with Field Offices and Partners. The External ESB is responsible for managing Cloud Computing Services in the future and the connection to external APIs to utilize the Cloud Computing based applications.

As a component allowing the external users or applications to integrate with the Company's applications, the Application Programming Interface (API) is a critical "gateway" between the external world and the internal Core IT Infrastructure.

The Business Process Manager subsystem is responsible for invoking Business Processes defining the work flows for both internal and external communication.

Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

Final Recommendations

Finally, the students recommended the Company to carefully examine the following actions to develop their next generation IT system infrastructure.

• Until the Cloud security management matures, consider migration of only non-sensitive data and low risk applications as a logical first step.

Conclusion

After the SIAF was presented to the executives and IT management of the Company, it received high praise from the audience. It was commonly acknowledged that the most impressive achievement by the students was that they had correctly considered security at every level of the system. They also successfully balanced the benefits and risks involved in the Cloud Computing. The most attractive feature of their proposal was that it enabled the Company to gradually replace future applications development with Cloud Computing Services, while, smoothly and securely integrating these results with the Company's own Core IT Infrastructure. The students work had fully met the requirement. And the objectives of the program were also met completely.

During the final discussion on the project, most of the students had credited their success back to the security courses taught in the program, which had prepared them well for dealing with the security related issues in the project.

Therefore when the students correctly answered the question: "How to secure the Cloud based Enterprise Information System", and succeeded in their EIS Capstone project; our question: "Is the emphasis on security courses right?" had also been clearly answered. Indeed, the security education in the MS in EIS program played a critical role in our students' success.

Fig. 1 .

 1 Fig. 1. Service Integration Architecture Framework Below is the simplified version of students' proposal.

  meet such needs, Colorado Technical University (CTU) created a new master program named Master of Science in Enterprise Information Systems in the late of 2008. This program has set up the following core outcomes [1]: • Plan, implement and use technology within a broad business and real world perspective • Demonstrate the ability to critically analyze and solve technical issues as they are related to the enterprise • Demonstrate the ability to design, implement and manage technology solutions to achieve enterprise goals • Exercise strong interpersonal and team communication skills • Demonstrate the skills necessary to perform all actions within an ethical framework Proceedings of the 7 th World Conference on Information Security Education 9-10 June 2011, Lucerne, Switzerland

	The program consists of the following courses:
	• Computer Networking
	• Security Management
	• Database Systems
	• Enterprise Systems Architecture
	• Enterprise Information Systems
	• Information Technology Systems Development
	• Project Management Process in Organizations
	• Schedule and Cost Control Techniques
	• Enterprise Information Systems Capstone
	• 2 elective courses from the list course listed below:
	─ Software Information Assurance
	─ System Security Certification and Accreditation
	─ Software Project Management
	─ Applied Managerial Decision-Making
	─ Project Planning, Execution and Closure Impact on Design & Production

2 What are the Real Requirements?

	Proceedings of the 7 th World Conference on Information Security Education
	9-10 June 2011, Lucerne, Switzerland
	This first EIS Capstone course was sponsored by the global Information Technology
	(IT) department of a multi-national enterprise. For convenience, in the rest of this
	paper, we will call this enterprise "the Company." The EIS Capstone course was
	scheduled for 11 weeks, and this cohort had total of 12 students. During the first week
	of the class, we went through the requirements of the EIS Capstone class and also
	reviewed various key concepts of Service Oriented Architecture and Cloud

Table 1 .

 1 Comparisons of Various Types of Cloud Computing Services

	Type of Cloud	Private Cloud	Public Cloud-IaaS	PublicCloud-PaaS	PublicCloud-SaaS
	Computing	(On Premise)	(Infrastructure as	(Platform as a	(Software as a
	Service		a Service)	Service)	Service)
	Control	Organization	Shared Control	Vendor Control	Vendor Control
	Computing	Control
	Resources
	Data Security	Low	Medium	High	High
	and Privacy
	Risk
	Data	High	Medium	Low	Low
	Management
	Cost
	Existence and	Matured	Reviewed	Proposed	Proposed
	Standards for	(ISO/IEC27002)	(ISO/IEC27002	(Cloud Security	(Cloud Security
	Cloud Identity		(2005))	Alliance established	Alliance established
	and Access			in 2008)	in 2008)
	Management
	(IAM) Tools
	Requirements	Lowest	Low	Medium	High
	for Federation
	IAM Tools
	IT Application	Highest	High	Medium	Low
	Development
	Cost
	Security and	Low	Medium	High	Highest
	Privacy
	Management
	Cost
	IT Operation	Low	Medium	High	High
	Scalability
	Overall IT	High	Medium(high end)	Medium	Medium (low end)
	Operation Cost

•

  Effectively supporting the responsibility in terms of Physical Administrative Access, Logical Administrative Access, Object Sharing and Maintenance of the data which are well defined in the Service Level Agreement (SLA). • Being able to test and verify the capabilities of the Secured and Virtual Storage, Disaster Recovery or Continuity of Operation declared by the cloud service providers. • Being flexible enough to smoothly switch among the various mode of an IT

  • Develop more mature Identity and Access Management capabilities within the enterprise while the Cloud Computing Service community coalesces.• Utilize ESBs to route and translate messaging for both internal and external users, which sets the stage for the Company to adapt to Cloud Computing.

Acknowledgement

The author sincerely thanks all the students who participated in the EIS Capstone class described in this paper. Much of the technical content and the conclusions made in this paper about the Service Integration Architecture Framework project are directly based on their excellent work.


Helen Armstrong
email: h.armstrong@curtin.edu.au

Ron Dodge
email: ronald.dodge@usma.edu

Colin Armstrong
email: colinarmstrong@gailaad.com

Reaching today's Information Security students

Keywords: information security education, Generation X Y, Net Generation

Classes at university today comprise students from the Baby Boomers, Generation X and Y. The different outlooks on life of these generations affect their choice of education options and their learning preferences. There are numerous ways academics can innovatively deliver Information Security learning materials that meet the needs of these generations, whilst still achieving the educational goals. This paper discusses some observations of students in the different generations in information security courses and methods that may be used to ensure a more meaningful learning experience for both the teacher and the learner.

Introduction

Information Security approaches and techniques are constantly shifting and new approaches emerge as technology progresses and society changes. It is important to continually update information security teaching and learning methods as well as the content of education and training in line with these new directions. However, education encompasses both teaching and learning and methods of achieving the learning objectives must be sufficiently flexible to cope with a changing body of learners. We, as information security educators need to be cognizant of the characteristics of the students we teach, as well as being aware of the different learning styles of different generations. This paper describes the characteristics of our current student body and discusses pedagogical requirements to best engage them. We then present some methods by which academics teaching information security at tertiary level can make the learning experience both meaningful and fun for the learner

Characteristics of the Generations

Three main generations are represented in our information security student body today: Baby Boomers, Generation X and Generation Y. It is very easy to assume that all students born within a particular time frame will exhibit characteristics of their stylized generation and the authors are aware that this is not always the case each student is an individual and they cannot all be the same, however they will have values and traits in common due to their shared social and historical experiences. The characteristics discussed in this paper are general and as such can only be used as a guide. It should be noted that the years forming the boundaries of each generation differs slightly between authors. It is also important to consider that some students will sit on the cusp between generations and may thus exhibit traits of more than one generation.

Baby Boomers

Baby Boomers were born during the period 1946-1954, just after WWII. They are confident of themselves and distrustful of authority, questioning the relevance of social structures. Their numbers are great, due to the increase in births encouraged to build the population after the two world wars. Demographics show a greater number of women than men, and the emergence of the quest for equality of the two sexes took a turn in favor of the females. Most families needed to have two incomes in order to survive and progress, initiating the concept of the "latch-key child". Baby boomers sought a college education, resulting in a boom in the tertiary education sector. Examples are Richard Branson, the entrepreneur who established the Virgin group of companies, and Bill Gates of Microsoft. Baby boomers are also familiar and comfortable with technology and computers.

Baby boomers see the instantaneous list of results from an Internet search engine an improvement on the extended time previously required to gather and analyze information from disparate sources. The lecture was the most efficient and cost effective means of getting information to a large number of students. The reading of books, analyses of the information gathered and then determination of the relevance of the information gathered, were necessary steps in the learning process. These are the oldest group of students in our classrooms, now being 55 to 63 years old. In many cases these students are attending to gain specialized skills and knowledge, driven by the need for qualifications for promotion or new employment. A small number are there for just the learning experience. These street-wise students bring a wealth of experience and knowledge into the classroom. On the downside, this generation can also be staid in their ways, believing that their way is the only way.

Generation X and Y

Generation X was born in the period between about 1965 and 1980. Gen Xers have been described by the media as practical skeptics and entrepreneurial free agents who fueled the dot-com boom [START_REF] Rickes | Make way for millennials! How today"s students are shaping higher education space[END_REF]. Xers have also been called the MTV generation due to their short attention span. They are emotionally secure, informal, and have distain for corporate politics and bureaucracy, and company loyalty holds less importance than to Baby Boomers. Nagle suggests this generation saw their workaholic parents downsized and restructured out of their chosen careers [START_REF] Nagle | Coaching Generation X[END_REF]. Although Gen Xers view work as something they have to do to live (but not to define their life) they will work hard for something they believe in, something that challenges them, or something that will build new desirable skills. Currently aged between about 30 and 45, Gen Xers return to college primarily to complete unfinished business, for career advancement, career security, a career change, or to pursue hopes and dreams [START_REF] Black | Gen Xers Return to College: Enrollment Strategies for a Maturing Population[END_REF]. Examples of well known Gen Xers are Nicole Kidman and Heath Ledger.

Generation Y students were born between the mid 1970"s and 2001, with Baby Boomer and Gen Xer parents. This group is accustomed to constant change. Also known as Millennials these students first appeared on campuses near the turn of the millennium. They are sometimes called the trophy generation as each one is recognized for participating and everyone gets a trophy. They "graduate" from all levels of schooling including kindergarten. They are achievement oriented, very technically savvy and want to make an immediate impact with little effort. Each child is recognized as "special" with individual wants and needs, to which customdesigned solutions are applied. They are team players and are socially aware, with a desire to solve society"s problems. Millennials see colleagues as a resource for tapping for important and influential information rather than investigating and finding out via their own research efforts. They harness new social technology to the maximum, constantly time sharing across a number of electronic forums such as email, FaceBook and MySpace whilst attending to other tasks. They have a fundamental need for structure from within and without for guidance [START_REF] Nagle | Coaching Generation X[END_REF], preferring small goals with tight deadlines and seek to be guided, and advised of, all boundaries so as not to waste time. They seek to add as much to their portfolio as they can. Breadth is more important than depth and the journey is only a means to get to their destination [START_REF] Howe | Millenials go to College, 2 nd Edition[END_REF]. They move quickly on to the next task. This group expects instant gratification because their needs have always been met immediately. Examples of this generation are Paris Hilton and Brittany Spears.

Post Modern Students

The majority of American students in Generations X and Y with normal media exposure have postmodern social characteristics [START_REF] Payne | Communication challenges for management faculty involving younger Generation[END_REF]. These characteristics include: a leveled view of authority and the importance of their own opinion, belief that experience is more important than knowledge, avoidance of pursuit for deeper meanings, preference for passiveness, and a consumer orientation to almost everything. Conflict is likely to arise in situations where current teaching methods and curricula are predominantly modernist as is the case in many universities [START_REF] Payne | Communication challenges for management faculty involving younger Generation[END_REF]. As our student body today is comprised of mainly Gen Xers and Yers, academics teaching information security courses need to harness postmodern approaches to effectively educate students with the characteristics summarized in Table 1. As new students progress through their tertiary education they are required to adjust to the different expectations and learning activities associated with a higher learning environment. The need to research (rather than Google search) and think (rather than having an answer given) are features of higher learning. As the majority of tertiary learning environments are still based upon the values and beliefs of the Baby Boomer generation many new tertiary students become frustrated and withdraw from their courses. It must be borne in mind that university education is not offered to solely provide skills and training (which more closely meets the needs and expectations of these generations), but an education in its richest sense. An education encourages thinking, and research; the building of concepts and theory, and the application of such theories into practice. Many current students do not see the value in their degree studies as they are not able to convert their learning into immediate practical skills. In order to provide such an education academics need to not only manage the expectations of new students but also adjust their methods of teaching so more value is obtained by the students at the same time deeper learning takes place.

Pedagogy Approaches and Information Security

Many approaches have been postulated to engage today"s college-aged students, one of which is the Postmodern Pedagogy. This approach recognizes that students require engaging experiences to fully capture their interest and encourage learning. This is the first step in transformational or adult learning models [START_REF] Tsao | Transformative Learning[END_REF].

The description of Postmodern Pedagogy in Taylor [START_REF] Taylor | Generation neXt comes to college: 2006 updates and emerging issues[END_REF] identifies that the traditional studentinstructor relationship is significantly different from the generations before Gen X. Students are no longer driven by a situation where they are expected to please the instructor; instead, instructors are required to compete for student enrollments as a service provider. Faculty success is measured by the pass rate of students. When a course has an exceedingly low grade average, the thought is not, "why aren"t the students learning", it is "why is the instructor not reaching the students". In addition to the relationship and the faculty role changing, the expectation of students is also different. Students are enrolled in Bachelor and Masters programs with a goal of post education employment. They demand applicable curriculum that will enable them to be immediately effective in their chosen career field. In the IT field, this typically involves the certification preparation where detailed technical, "hands on" skills are required. Postmodern Pedagogy further defines methods instructors may use to construct curriculum to meet the demands of the new teaching environment. We group these into two broad categories, assessing the student"s learning paradigm and constructing a learning conducive environment. In the former, instructors must identify the goals of the students and help the students realize the importance. In the latter, the learning environment must use techniques and technologies beyond lecture. Specifically called for is an increased activity in learning. Studies have concluded that experiential based curriculum strategies result in a higher degree of learning [START_REF] Greenberg | Hands-on learning in biomedical signal processing[END_REF][START_REF] Mountain | Work in progress -applied process control systems design: hands-on laboratory experiences for multiple disciplines and academic levels[END_REF]. In IT fields, this commonly involves hands-on laboratory exercises. Material should be delivered in multiple formats and the instructor should be available via several mediums (office hours, email, SMS, and the like). Finally, the assessments used must be meaningful. For students memorizing principles and theorems holds no importance to them. We must find a way to embed them into learning goals where the assessments require the student to demonstrate an understanding of the principlenot merely repeat it.

Information security education requires that students have a fundamental understanding of many computer science foundational topics. That, however, is not enough. This knowledge must be applied against a constant changing landscape of aggressor and technology. The skillful attacker is really the kind of student that we would all like to have. He/she is engaged in hacking because they truly are engaged at the base level by a desire to assess a technology and predict how it will fail under specific circumstances (for a variety of motivations). To create and defend our systems against this motivated adversary, our students must be similarly engaged in the process. This level of learning is commonly referred to in Bloom"s Taxonomy [START_REF] Bloom | Taxonomy of Educational Objectives: Handbook I: Cognitive Domain[END_REF] as the Evaluation level. This is in conflict with the general trend of the post modern generations to understand only what is needed for short term objectives. The good news is that the requirement for information security education at colleges and universities is a relatively recent growth. Instructors are more and more coming to the task of educating with experience managing the very systems their students will be working with upon graduation. This common understanding of the market requirements provides a link not shared in other disciplines. Although teachers in information security programs are predominantly baby boomers, and some Xers they are progressive enough to willingly adapt teaching strategies, however, more than likely they still harbor much of the "lecture" mentality they experienced in education.

Closing the Gap

Experiential learning [START_REF] Kolb | Experiential Learning: Experience as the Source of Learning and Development[END_REF], or learning by doing is very important for this generation. Engaging the student in discussions and collaborating in hands-on exercises facilitates a better understanding of the concepts and motivates the student by applying knowledge in a recognizable manner. This interaction allows them to build the skills they pursue. The goal of information security education should be to develop a learning environment where students are required to apply knowledge and seek answers from group members or other students rather than relying on teachers for the answer. When developing an information security course, faculty should consider various ways to engage the student inside and outside of lecture. Several examples utilized successfully by the authors for reducing the gap and achieving objectives in information security include: Experiential: Design classes so they are practical in nature and require students to actively participate early in each class. Get students actively participating early in each session. Introduce the topic through a real world example. For example if the topic deals with social engineering use social engineering before class to demonstrate the ease at which the student would fall prey to the very topic of the lesson. Experiential learning enables students to concrete their learning and gain skills and understanding. Their concentration span can be extended as they learn and apply new concepts. Walk through practical tasks with them as the theory is being presented. For example, when teaching security policy implementation via firewall rules set the students an exercise to specify the firewall rules as the table is developed, and implement and test it. Another example is giving computer forensics students a set of screwdrivers, a couple of surplus hard drives to dismantle, and an hour to explore at their own pace provides them with insights about the technology they would not achieve by reading a text book or viewing lecture slides.

Task Size: Break the learning session into small tasks allocating a short burst of time for each task. Information security is very open to teaching in smaller sections, with each section or task building on previous tasks. For example students could use password cracking software to gain access to passwords, and then use more secure methods to protect passwords.

Relevance: Show the relevance of the pedagogical materials to the course objectives and subsequent employment. Students respond positively when they can see the applicability and relevance of what they are learning. Understanding how security concepts apply in differing fields and situations is also helpful for students to see relevance in what they are learning. Using technologies the students know to reinforce lack of security in their Facebook and MySpace accounts brings home the need for certain security measures and an opportunity to explain how these work. Linking courses to external certification and standards also reinforces the relevance of the knowledge and skills being learned.

Examples and Instructions: For more complex tasks give unambiguous, concise instructions, clearly presenting what is required of the students, and the end product they are expected to produce. This links closely to making the material relevant. The end product needs to be something where the student can come away with a more clear understanding of what the objective was and whether they achieved it. Present examples to demonstrate key points. Students should be led through basic examples and then challenged to solve more complex ones that build from in-class examples.

Contemporary Tools: Use interactive media and interaction and provide multiple ways to access the material. Rich interactive media engages students and holds their interest. This content should be available in multiple formats. For lectures, the material can be recorded for "pod cast" or videotaped. Labs or exercises should be accessible from multiple endpoints. Several universities have developed technologies to enable student access from almost anywhere. Multiple formats of the learning materials also provide access to those students with disabilities. Use new technologies as teaching and learning tools, i.e. set assessments and exercises so that students can use the technologies they know, i.e. Second Life, games, etc. Use online references and sources of information. Students should be able to seek additional information when not in class. Instructors can assist by providing links to current additional references that students can use to investigate further.

Groups: Undertake exercises in small groups to encourage confidence. Students are comfortable with this approach as they gather in small groups to discuss assessments and to study. Network security can be presented in such a way that students establish a small network (a virtual environment using tools such as VMWare works really well), then attack each other"s networks to test robustness.

Non-assessment: Set practical exercises that are not assessed. This encourages the students to participate and learn without the fear of not succeeding. For example a moot court exercise enables computer forensic students to demonstrate concepts and processes and thus be able to credit themselves with a specific set of skills without undergoing what they see as a formal academic assessment or examination.

Conclusion

Educating a mix of information security students from different generations means teachers and students need to interact in a common space. This requires an understanding of the characteristics and learning styles of each generation, plus the flexibility to adjust methods to achieve the learning objectives to the benefit of all. However, it also requires a full understanding of the learning objectives and their relevance to the world the students will enter on completion of their studies. Postmodern students respond positively to relevant and practical learning and the information security field is well placed to set these students up for success in their learning journey.

Table 1 .

 1 Characteristics of Post Modern Students

	General	Learning Related
	Short concentration span	Desire a challenge
	Desire individual recognition	Want to build skills quickly
	View own opinion is important	Prefer small goals with tight deadlines
	View the destination as more important	Share information readily and use each other as a
	than journey	source of information
	Passive	Prefer limits and structure, and need clear guidance
	Desire immediate impact with little	Choose breadth rather than depth in researching new
	effort	topics
	Gather trophies and accolades	Only retain information deemed relevant
	Use social technology constantly	Information needed is gathered just in time


Lynette Drevin
email: ldrevin@acm.org

Hennie Kruger
email: hennie.kruger@nwu.ac.za

Tjaart Steyn
email: 3tjaart.steyn@nwu.ac.za

Determinants of password security: some educational aspects

Keywords: Password management, ICT security awareness, Pareto analysis, cause-and-effect diagrams, password strength and confidentiality

Development and integration of technology give organisations the opportunity to be globally competitive. However, the potential misuse of Information Technology (IT) is a reality that has to be dealt with by management, individuals and information security professionals. Numerous threats have emerged over time in the networked world, but so have the ways of alleviating these risks. However, security problems are still imminent -as highlighted by the plethora of media articles and research efforts. The insider risk is stated as being around 80% of security threats [1] in a company. With this statistic in mind, management has to plan how to allocate resources to counteract the risks. Very often, simple measures such as good password behaviour are overlooked or not rated high enough to include in all security awareness programmes. This paper will focus on a study that assesses password management of future IT professionals. It will be demonstrated how management and educators can use these results to focus their efforts in order to improve users' password practices and thereby enhancing overall IT security.

Introduction

With the increased usage of information systems and e-business, it has become important to protect information against a wide variety of threats, such as social engineering attacks leading to phishing and identity theft, viruses, spyware, and denial-of-service attacks. There are users in the networked world who are adequately protected, but many individuals are novice users who are ignorant or simply unaware of these vulnerabilities. They spend hours online on social network groups, online banking applications and other systems. Businesses have also changed work practices. Many e-applications are currently in use, such as e-commerce, e-government and e-health. With the use of these and other applications, the previously mentioned risks also pose challenges to the management of organisations that need to allocate budgets to every aspect of business -including the protection of information resources. Information security includes not only technology solutions but also people [START_REF] Dark | Security education, Training and Awareness from a Human Performance Technology point of view[END_REF]. One of the most basic and important aspects of protecting access to applications and information is authentication. Users, employees, and management are all subjected to authentication processes to restrict access to authorised persons only. There are different ways to authenticate users, such as the use of a physical token (e.g. something you have), secret knowledge (e.g. something you know), or biometrics (e.g. something you are) [START_REF] Burnett | Perfect Passwords. Selection, Protection, Authentication[END_REF]. Commonly used is the mechanism of passwords. Studies have shown that the behaviour of users in this regard is not always of a high standard; therefore, the quality of password security is impeded [START_REF] Pfleeger | Security in Computing[END_REF], [START_REF] Wiedenbeck | PassPoints: Design and longitudinal evaluation of a graphical password system[END_REF]. Users should be made aware of what good password behaviour entails, how to manage their passwords and what the related risks are.

One could argue that the last word has been said about password management, as much has been published on password usage and behaviour. However, it remains highly topical, as can be seen in recent research publications. Examples include graphical passwords [START_REF] Wiedenbeck | PassPoints: Design and longitudinal evaluation of a graphical password system[END_REF], social practice of passwords [START_REF] Singh | Password sharing: implications for security design based on social practice[END_REF] and improvement of passwords through persuasion [START_REF] Forget | Improving text passwords through persuasion[END_REF].

Bearing in mind the increase in the number of information users and online applications and the resulting risks, a study was undertaken to provide some insight into the determinants that may impact the standard of password management and behaviour of users. In this study, a measuring instrument was developed and certain techniques applied in order to identify and prioritise important factors when assessing future IT users' perspectives on password usage.

The important password management determinants that emerge from this study will allow management and educators to expend their efforts in order to improve password practices. The remainder of the paper is organised as follows: In section 2, the background to the exercise is given. Section 3 discusses the methodology used. Section 4 details the results of the study, and section 5 presents some concluding remarks.

Background

This study stems from a framework developed during 2006 to evaluate ICT security awareness levels [START_REF] Kruger | A framework for evaluating ICT security awareness[END_REF]. One of the key areas identified in this framework was the acquiring of appropriate data that could be useful to evaluate knowledge and behaviour of users. Password-related information was part of the required data. It was decided to focus this study on evaluating password management and behaviour of students who are the future IT users and IT business leaders.

The literature gives numerous examples of good password practices [START_REF] Pfleeger | Security in Computing[END_REF], [START_REF] Burnett | Perfect Passwords. Selection, Protection, Authentication[END_REF], [START_REF] Gollmann | Computer Security[END_REF]. Studies to improve authentication through the use of passwords are also in abundance and guidelines are given to address password insecurities [START_REF] Vu | Improving password security and memorability to protect personal and organizational information[END_REF], [START_REF] Wiedenbeck | PassPoints: Design and longitudinal evaluation of a graphical password system[END_REF], [START_REF] Singh | Password sharing: implications for security design based on social practice[END_REF].

Users from all backgrounds and educational levels use IT and online applications; therefore, the advice given in literature on how to increase password efficiency can be applied by all. As mentioned, this study focuses on students in a university environment and on the assessment of their password practices. Universities are managed and operated these days in much the same way as other businesses, although their main activities are education and research. They also rely heavily on ICT resources and should therefore be secured so as to adhere to the confidentiality, integrity and availability principles. Student users are given access to systems and applications mainly via user accounts and passwords. They are restricted to their own systems and networked areas and should not have access to university systems containing marks, examination papers, financial data, etc. Failing to keep passwords confidential and making use of passwords that can easily be guessed could result in considerable financial losses and/or examination irregularities. Apart from the usual dishonest behaviour that should be avoided, it seems appropriate to assess the password behaviour and attitudes of young people. They are the IT users and ICT professionals of tomorrow and should be educated about threats and consequences of inadequate password practices.

We viewed effective password management in terms of two categories -strong or secure passwords and confidentiality of passwords. It is assumed that these two aspects define "good" and "poor" password practices. The two categories were derived from existing literature that provides guidelines on the use of passwords [START_REF] Pfleeger | Security in Computing[END_REF], [START_REF] Furnell | An assessment of website password practices[END_REF].

Strong or secure passwords include principles such as: Choose long passwords Change passwords often Avoid names or dictionary words Confidentiality of passwords includes principles such as: Do not write them down Do not use the same password for all applications Do not tell anyone your passwords

To comprehend ineffective password management of users, cause-and-effect diagrams were constructed. Also known as an Ishikawa diagram or a fishbone diagram, a cause-and-effect diagram can be used to represent the relationship between some effect that could be measured and the set of possible causes that produce the effect [START_REF] Berenson | Basic Business Statistics. Concepts and Applications[END_REF]. The effect or problem is shown on the right-hand side of the diagram and the main causes are listed on the left. The causes can be further divided into a few major categories, depending on the problem at hand. Within each major category, specific causes can be listed as branches or sub-branches. These diagrams are useful when it is necessary to understand processes or to identify core causes of problems. The construction of the cause-and-effect diagrams was guided by the following two questions:

"What is causing the ineffective password management of students?" "What factors affect the ineffective password management of students?" The next section describes the methodology used, i.e. how the cause-and-effect diagram and the measuring instrument were developed.

Methodology used

Cause-and-effect diagram

It was assumed that the effectiveness of password management is influenced by two main factors, namely strong passwords and confidentiality of passwords. Two cause-and-effect diagrams were constructed for these two factors, using the following two problem statements: "Strong passwords are not used" and "Passwords are not kept confidential".

In order to establish the causes of the problems, the argument of Dark [START_REF] Dark | Security education, Training and Awareness from a Human Performance Technology point of view[END_REF] was used, where human performance is described as a function of ability and motivation. This assumption provided a framework of categories that was used in the diagrams. The final cause-and-effect diagrams were developed using research strategies such as brainstorming sessions by the research team, validation against appropriate literature [START_REF] Pfleeger | Security in Computing[END_REF], [START_REF] Burnett | Perfect Passwords. Selection, Protection, Authentication[END_REF], [START_REF] Furnell | An assessment of website password practices[END_REF] and the use of pilot studies. Figure 1 shows the final cause-and-effect diagram for the confidential password problem [START_REF] Kruger | Password management assessment[END_REF].

Development and validation of the instrument

The construction of the cause-and-effect diagrams was followed by a data gathering process to determine the significant causes that impact the problem. This was done by converting causes identified on the two diagrams into a questionnaire. The objective was to test and empirically validate the factors that may influence the effectiveness of password management. A list of 23 causes was identified as relevant to secure passwords and the confidentiality of passwords. These causes were then grouped into main categories with the help of validation techniques such as content validation, reliability tests and construct validation. The final result was a 5-factor instrument (questionnaire) consisting of 23 items [START_REF] Kruger | Password management assessment[END_REF]. The secure/strong aspect was tested by 12 items, and the confidentiality dimension by 11 items.

In order to distribute the questionnaire, a web application was used to reach the students and to capture responses. The next section presents the results.

The experiment was conducted at a South African university with three campuses located in three different citiesone of which was selected for the exercise. The campus has a well equipped ICT infrastructure and the students are linked to a central network that gives access to all the necessary applications that they need for their studies. Apart from a compulsory computer literacy module, no official security awareness programme is offered to the students.

Figure 1 -Cause-and-effect diagram for confidential passwords

Following a number of pilot studies, e-mail messages were sent to 9 different selected class groups with students ranging from first to fourth year and from different study disciplines. They were requested via e-mail and by their lecturers to complete the web-based questionnaire; 395 responses were subsequently received and completed.

The final results were presented as Pareto charts, which are graphical views with bars that are used to present information in such a way that priorities and relative importance of data can be identified. Pareto charts are often used by managers to direct efforts to the biggest improvement opportunity by highlighting the vital few causes in contrast to the trivial many [START_REF] Diagram | [END_REF]. The charts are constructed by arranging the bars in decreasing order from left to right along the x-axis, and the cumulative percentages are then used to assist with the analysis of the charts. Figure 2 contains the Pareto chart for the factors relevant to confidential passwords. More Pareto charts were constructed to present the individual items that contribute to confidential passwords. A similar chart was constructed for the strong password section, which is not presented here.

Figure 2 -Pareto chart per factor for confidential passwords

From figure 2, we can see that the Expectations and Feedback factor is the most significant determinant that needs to be addressed in order to improve the confidentiality aspect of password management among students. Two items ("keeping passwords confidential is compulsory in my work environment" and "confidentiality of passwords is an important issue in my work environment") were used to measure this aspect. Based on the responses, and as shown on the Pareto chart, the perception is that the current message (feedback) that students receive from management, lecturers, their environment, their peers, etc. is that confidentially of passwords is not really important and also not compulsory. It is not really expected of students to keep passwords confidential and the practice thereof is not verified. When interpreting the Pareto chart for individual items (which is not presented here), the mutual importance of each item can also be established to guide educational efforts. In this survey, the most important individual item, which explains almost 20% of the confidentiality problem, is: "keeping passwords confidential is compulsory in my work environment -it is regularly checked to see if people keep their password confidential". The next item, explaining another 18% of the confidentiality problem, is: "I know where to get help or information regarding the confidentiality of passwords". These pieces of information determine the important factors, so that management can address specific password behaviour and practices instead of implementing a comprehensive awareness programme. Each of the factors, as well as their related items, can be analysed similarly.

Pareto

The most significant results that were revealed from this study when interpreting the Pareto charts are as follows:

Proper use of passwords, including the use of strong passwords and keeping passwords confidential, is compulsory.

Passwords are an extremely important aspect of ICT security and improper use will degrade the quality of security and increase the probability of a number of security risks. The use of simple passwords that can easily be remembered is not acceptable.

Users should be made aware of what confidentiality entails and how to get help on this aspect of password management. Making passwords available to others is not allowed. If the above five principles (relating to specific items) could be addressed in security awareness programmes, it would be possible to solve approximately 54% of the problems related to effective password behaviour. The remaining factors and their linked items can be interpreted in the same way. We could also ascertain with this tool that tomorrow's IT users generally have the necessary skills, e.g. they know where and how to change passwords; they generally have a positive attitude or viewpoint towards effective password management, e.g. they think that it is worthwhile to use strong and confidential passwords, and they do not claim to be too busy to concern themselves with strong and confidential passwords.

The above results indicate that educational efforts could be directed more efficiently to focus on problematic aspects of password behaviour.

The following section concludes the paper.

Summary and conclusions

As a result of the increased usage of online applications -where passwords are almost always used in the authentication process -and the accompanying threats in the cyber world, all users need to be aware of good password practices. This paper addressed the password management problem as an essential element in the information security education arena. A study was conducted at a university to identify the important factors that need to be addressed in order to improve password behaviour. Should an organisation be able to identify and prioritise those significant factors that have an impact on password behaviour, focused awareness programmes can be implemented in such a way that specific issues are addressed. In doing so, financial and other resources can be used more effectively and efficiently. It was shown that tools such as Pareto charts can be valuable. These charts can help identify the important determinants influencing password behaviour among IT users. Educational programmes should include these important factors. 1

This paper is based upon work that was financially supported by the NRF: Grant Number FA200703080000. The opinions expressed in this paper are those of the authors.