Natalia Miloslavskaya

Alexander Tolstoy

Keywords: Information Security Education, Specialist Training, ISO/IEC 27002

Information Security (IS) specialists' training for all sectors of trade, industry and government has never been more important as intellectual property and other sensitive or business-critical information becomes the life-blood of many companies today. Analysis of the experience collected within training of IS specialists at the Moscow Engineering Physics Institute (State University) (the MEPhI) at the Information Security Faculty allows forming the basic requirements to the level of their preparation. To form such requirements it is expedient to take a look at the types and tasks of professional activity of the graduates and to formulate their qualification characteristics. This paper formulates these characteristics on the basis of ISO/IEC 27002 (former ISO/IEC 17799:2005).

ISO/IEC 27002

A family of Information Security Management System (ISMS) International Standards, being developed within Joint Technical Committee ISO/IEC JTC 1/SC 27, includes International Standards on ISMS requirements, risk management, metrics and measurement, and implementation guidance. The ISO/IEC 27002 Standard -Information Technology -Security Techniques -Code of Practice for Information Security Management‖ gives comprehensive guidance on best practice methods for implementing ISO/IEC 27001 -Information Security Management Systems Specification‖, which specifies requirements for establishing, implementing, maintaining, improving and documenting ISMS for both public and private sector organizations.

ISO/IEC 27001 is the de-facto international standard. It specifies requirements for establishing, implementing, maintaining, improving and documenting ISMS for both public and private sector organizations. It specifies security controls to be implemented by an organization following a risk assessment to identify the most appropriate control objectives and controls applicable to their own needs. This standard forms the basis of an assessment of the ISMS of the whole, or part of an organization and covers the eleven clauses of good IS practice: Security Policy; ISO/IEC 27002 [1] as a technology independent standard offers a framework to assist any organization to develop a true security minded corporate culture by instilling best practice and detailed guidance regarding all manner of security issues. The guiding principles cover three main aspects: strategic, operational and compliance. ISO/IEC 27002 concentrates on the IS management aspects, defining the controls in enough detail to make them applicable across many different applications, systems and technology platforms without losing any of the benefits provided by standardization. The main characteristics of ISO/IEC 27002 are the following: proven value; widely known and accepted; easy to understand; continuous value; market driven; flexible; adaptable; scalable and so on.

Thus ISO/IEC 27002 provides a stable and comprehensive base for formulating the qualification characteristics of IS specialists, being capable to design, implement and control IS at various types of business organizations. Alignment with the standard also offers a high level of standardization in training worldwide with skills and knowledge set founded upon a uniform, known and acceptable base.

IS Specialists' Training and International Standards

Comprehensive security requires secure technologies, organizational processes and people with the necessary background and skills. A large number of certifications are found in the field of IS.

(ISC)² offers the Systems Security Certified Practitioner (SSCP) and the Certified Information Systems Security Professional (CISSP) certifications. The Information Systems Audit and Control Association (ISACA) has a pair of vendor-neutral credentials: the Certified Information Systems Auditor (CISA) and the Certified Information Security Manager (CISM). CompTIA Security+ certification exam covers communication security, infrastructure security, cryptography, access control, authentication, external attack, and operational and organizational security. Software provider Check Point offers a range of security and security management certifications that deal with both general skills and knowledge as well as the company's specific solutions: the Check Point Certified Security Principles Associate (CCSPA), the Check Point Certified Security Expert (CCSE), the Check Point Certified Managed Security Expert (CCMSE). In the Cisco qualified specialist category, there are a few certifications around specific areas of security, including the Cisco Firewall Specialist, the Cisco IDS Specialist and the Cisco Certified Security Professional (CCSP) and so on.

The Global Information Assurance Certification (GIAC) organization, being founded in 1999 by the SANS Institute to validate the real-world skills of IT security professionals, has the main purpose to provide assurance that a certified individual has practical awareness, knowledge and skills in key areas of computer and network and software security.

The SANS training and GIAC certifications address a range of skill sets and some advanced subject areas such as audit, intrusion detection, incident handling, firewalls and perimeter protection, forensics, hacker techniques, Windows and Unix operating system security.

GIAC currently offers certifications for over 20 job-specific responsibilities that reflect the current practice of IS. At present GIAC certifications cover four IT/IT Security job disciplines: Security Administration, Management, Audit, Software Security.

The SANS training course -SANS 17799/27001 Security & Audit Framework, Mgt-411‖ implements step by step pragmatic examples to move quickly into compliance with the standard and certification. This track is designed for IS officers or other management professionals who are looking for a how-to guide for implementing the standard effectively. -GIAC Certified ISO-17799 Specialist‖ (G7799) candidates must demonstrate understanding of the standard and the ability to put it into practice.

Summing up all these certifications it is possible to state that the international perspective of IS specialists' training should be focused on the following international standards: ISO/IEC 27002/27001, Common Criteria, ITSEC and IS bodies of knowledge recommended by professional computing organizations [START_REF] Colin | Mapping information security curricula to professional accreditation standards[END_REF].

Initial Data for Formulating Qualification Characteristics

"IS specialist" term applies to many positions, responsible for finding and solving security problems in computer systems. What the IS specialist actually does depends on many factors ─ the type and size of the employer, information that needs protection and computers the organization uses.

The basic qualification characteristics of a specialist with higher education are formulated on the basis of his/her special (professional) competences [START_REF] Andrey | Information Security Specialist Training for the Banking Sphere[END_REF] -abilities to solve definite problems and carry out specific work within his/her line. IS specialists must be able to do a number of tasks, to think logically, to pay attention to details and to make sure their work is exact.

Formulating the qualification characteristics is possible only when considering separate typical objects where IS tasks are being carried out. ISO/IEC 27002 analysis shows that there is enough information to formulate the qualification requirements for specialists, ensuring functioning of IS systems of any organization.

The Russian universities allow up to 1 year for practicing and preparing of the graduate qualification paper (diploma project) (for example, the MEPhI students have 10th and 11th semesters). During this period graduates' activities within a specific organization can be divided into three main streams.

1. Forming the goals of ensuring organization's IS (is based upon defining assets to be protected, all types of vulnerabilities, IS paradigm and basic principles, threats' and IS violators' models, implementing risk assessment and forming IS policies).

2. Implementation of these goals (via services/systems/personal). IS monitoring and auditing (external, internal, self-assessment against policies, procedures, standards). To define functions of IS specialists working within concrete objects it is necessary to define IS role for those objects and line of IS specialist activity. Such information could be obtained upon analysis of ISO/IEC 27002.

IS Role at Protected Objects

ISO/IEC 27002 defines IS role for any organization as "…the protection of information from a wide range of threats in order to ensure business continuity, minimize business risk, and maximize return on investments and business opportunities. IS is achieved by implementing a suitable set of controls, including policies, processes, procedures, organizational structures and software and hardware functions. These controls need to be established, implemented, monitored, reviewed and improved, where necessary, to ensure that the specific security and business objectives of the organization are met." [1]. Thus when training IS specialists, peculiarities of protected objects should be taken into consideration and they should be reflected in their qualification characteristics.

But it is also important to define subjects that could interact with each other in situations when IS risks could appear. The standard defines the following subjects: owner of organization's assets and violator trying to influence those assets. IS role is defined by the tasks being carried out within the conditions of opposition of an owner and a violator for the control over the assets.

While indentifying its security requirements an organization should consider three main sources. The first one "…is derived from assessing risks to the organization, taking into account the organization's overall business strategy and objectives. Through a risk assessment, threats to assets are identified, vulnerability to and likelihood of occurrence is evaluated and potential impact is estimated." The second "…is the legal, statutory, regulatory, and contractual requirements that an organization, its trading partners, contractors, and service providers have to satisfy, and their socio-cultural environment." And the third "…is the particular set of principles, objectives and business requirements for information processing that an organization has developed to support its operations." [1].

IS risks, whose essence is natural vagueness of the future, are an objective reality and they could be lowered only to the level of vagueness of subjects characterizing the nature of business. The remaining part of IS risk defined by the factors of the environment of organization's functioning, for which organization cannot influence at all, should be accepted. In that case ensuring IS at an object should lower risks to a certain level.

After that phase an organization should implement the IS goals ─ "appropriate controls should be selected and implemented to ensure risks are reduced to an acceptable level… The selection of security controls is dependent upon organizational decisions based on the criteria for risk acceptance, risk treatment options, and the general risk management approach applied to the organization, and should also be subject to all relevant national and international legislation and regulations." [1]. The controls can be considered as guiding principles for IS management and applicable for most organizations.

Ensuring IS for an organization is the process that should be efficiently managed. The main IS role is defined by the organization's IS strategy which lies in ISMS deployment, exploitation, check and improve. Along with that IS management is a part of the overall corporate organization's management which is oriented for reaching organization's goals through ensuring protection of its assets. An organization's ISMS is a part of the overall management system based on the business risk approach whose goal is to create, implement, operate, monitor, analyze, support and rise IS of an organization (ISO/IEC IS 27001).

IS Specialist Line of Activity

It is possible to formulate the main lines of activity of IS specialist on the basis of the section 0.7 of the ISO/IEC 27002 standard:

"a) IS policy, objectives, and activities that reflect business objectives; b) an approach and framework to implementing, maintaining, monitoring, and improving IS that is consistent with the organizational culture; c) visible support and commitment from all levels of management; d) a good understanding of the IS requirements, risk assessment, and risk management; e) effective marketing of IS to all managers, employees, and other parties to achieve awareness; f) distribution of guidance on IS policy and standards to all managers, employees and other parties; g) provision to fund IS management activities; h) providing appropriate awareness, training, and education; i) establishing an effective IS incident management process; j) implementation of a measurement system that is used to evaluate performance in IS management and feedback suggestions for improvement."

  [START_REF] Andrey | Information Security Specialist Training for the Banking Sphere[END_REF]. Control of progress in reaching IS goals based upon checks and evaluation of organization's IS (IS monitoring and audit) and defining maturity of organization's IS management processes.

	business continuity planning and management;
	ISMS design;
	design/development of information protection technologies, tools, means,
	system/subsystem;
	IS tools and services support and administering;
	physical and environmental security;
	human resources security;
	IS incident management;
	computer forensics;
	cryptanalysts (analyze hidden information);
	security administrators (develop/implement protection systems that detect,
	prevent, contain and deter security risks; update security procedures and
	establish and maintain access rules);
	IS incident response team members (work together to prepare for and provide
	rapid response to security threats);
	disaster recovery specialists (design and implement programs to recover data
	lost in a disaster);
	computer crime specialists/computer forensic investigators (preserve,
	identify, extract and document evidence if IS incident);
	IS auditors (evaluate IS adequacy, effectiveness and efficiency);
	chief IS officers (supervise the entire IS department and staff).
	Our experience collected since 1995 and ISO/IEC 27002 content analysis allow
	grouping practice and diploma project topics, incorporating technical,
	organizational and management aspects (with deeper specification than three main
	streams), as follows:
	risk management (including development of IS threats' and violators' models,
	asset management, vulnerabilities assessment);
	IS policies and procedures development;

These graduates act as the assistants for organization staff: privacy officers (develop/implement IS policies and procedures); IS architects (direct organization-wide security technology); IS analysts (conduct IS assessments for an organizations); virus technicians (analyze newly discovered computer viruses and devise ways to defend against them); "red team" testers (plan/carry attacks on the computer systems); cryptographers (keep information secure by encrypting it);

Information Security Specialist Training on the Basis of ISO/IEC 27002 6. Conclusion

Analysis of the experience collected within training of IS specialists with higher education at the MEPhI and of ISO/IEC 27002 allows one to define two types of IS specialist professional activity: technological (ensuring functioning of the main IS technologies) and organizational and technological (ensuring functioning of ISMS).

Qualification requirements are defined by the types of tasks being carried out by the specialists and requirements to the level of knowledge and skills. Three main streams (listed in section 3) define three tasks solved (special competence). The level of knowledge and skills is associated with staff functions (section 3). These requirements have universality and do not depend upon national and other peculiarities of systems being secured. To conclude, future work should be on the basis of formulated qualification requirements and details of educational course content specified in IS curricula.

IS specialists should


William Caelli
email: w.caelli@iisec.com.au

Vicky Liu
email: v.liu@qut.edu.au

Dennis Longley
email: d.longley@iisec.com.au

Background to the Development of a Curriculum for the History of "Cyber" and "Communications" Security

Keywords: information assurance education, cybersecurity education, data network security, Internet security, history of computing, history of communications technology, information security, convergence

For any discipline to be regarded as a professional undertaking by which its members may be treated as true "professionals" in a specific area, practitioners must clearly understand that discipline's history as well as the place and significance of that history in current practice as well as its relevance to available technologies and artefacts at the time. This is common for many professional disciplines such as medicine, pharmacy, engineering, law and so on but not yet, this paper submits, in information technology. Based on twenty five elapsed years of experience in developing and delivering cybersecurity courses at undergraduate and postgraduate levels, this paper proposes a rationale and set of differing perspectives for the planning and development of curricula relevant to the delivery of appropriate courses in the history of cybersecurity or information assurance to information and communications technology (ICT) students and thus to potential information technology professionals.

Introduction

Why teach the history of cybersecurity and/or information assurance? The answer is that at least three distinct themes can be determined in relation to the position of cybersecurity/information assurance history in the creation, development and presentation of courses of study in the area. These are: 1. any profession that claims to be so, acknowledges and builds upon its history; 2. the profession of cyber and network security or information assurance should be no different in this way from any other profession such as medicine, law, science, military affairs and others and should build upon general education in the ICT area for both specialist and general professional activity in the discipline, and 3. the challenge is to make such history relevant to students in the age of total convergence in the information technology area and to relate it to current practice, products and systems.

The environment in which an educated cybersecurity professional will practice has been envisaged by Al Gore, former Vice-President of the USA in the following way in his book "The Future" [START_REF] Gore | The Future: Six Drivers of Global Change[END_REF]:

"The emergence of a planet-wide electronic communications grid connecting the thoughts and feelings of billions of people and linking them to rapidly expanding volumes of data, to a fast growing web of sensors being embedded ubiquitously throughout the world, and to increasingly intelligent devices, robots, and thinking machines, the smartest of which already exceed the capabilities of humans in performing a growing list of discrete mental tasks and may soon surpass us in manifestations of intelligence we have always assumed would remain the unique province of our species; " Given this scenario, vaguely reminiscent of the envisaged "Noosphere" of Vernasky and Chardin [START_REF]Noosphere[END_REF] and even the planetary intelligent machine of the "Krell" in the 1952 movie, "The Forbidden Planet" [START_REF]The Forbidden Planet[END_REF], loosely based on a Shakespearean play, the security and protection of such an information environment takes on new meaning and urgency.

In summary, for any discipline to be regarded as a "professional" undertaking, and whose members may then be accepted and treated by society at large as true "professionals" in that specific area, the discipline must ensure that its practitioners clearly understand that discipline's history as well as the place and significance of that history in current practice. This includes a clear understanding of the "what/how/why" of currently available technologies, including professional practice procedures and the like, as well as of ICT artefacts, including base products, integrated systems, services, etc.. This commonly forms an educational base for many professional disciplines such as medicine, pharmacy, engineering, law and so on but not yet, this paper submits, for information technology although references have been made to such histories on some curricula proposals and final versions as discussed later. This paper discusses such history against the consideration of the need for education and training of specific cybersecurity/information assurance professionals. The specific case of education and training in military level cyber-operations is not included in this discussion but is worthy of further analysis. It also has resonance with the more general requirements for cybersecurity awareness in any ICT education program.

Based on twenty five elapsed years of experience in developing and delivering cybersecurity courses at undergraduate and postgraduate levels, this paper proposes a rationale and set of differing perspectives for the development of curricula relevant to the delivery of an appropriate course in cybersecurity history to information and communications technology (ICT) students and thus potential information technology professionals. It does not propose specific curricula in a normal sense, as a set of topics, learning outcomes and the like but rather discusses the bases on which such selections could be made. It proposes particular emphasis on explanation of historical matters as these relate to information technology from differing perspectives which must be understood and catered for by the ICT professional in practice, e.g. interactions with users, managers and other ICT professionals. Particular emphasis is placed on the role of the ICT "professional" through education at the university undergraduate level in general as well as via specialised postgraduate cybersecurity program. It proposes that the basis for this curriculum could be set out on the grounds of perception of four distinct generations of information technology professionals within the information technology and data communications network environments in which they worked along with the growing perception of the related science and technology. One aim is to be able to invigorate students in a way that enables them to be able to understand and appreciate the background to any current cybersecurity product, system or service offering from, or claim made by, the ICT industry in general and the specific cybersecurity industry more particularly. The aim is to cover such developments over the last 50 to 60 years in both technological and societal contexts, winding up in an age of total convergence of computers, communications and content (3C) and to thus provide students with an engaging insight into "how we got here" and "why" products, systems and services are what they are and/or what they should be. A particular emphasis is placed on relating this history to the requirements of protection in a globally connected information services environment based around associated data networks and the environments in which new graduates will be employed.

Simply put, the current information environment may be considered the result of convergence of computers, communications and content, commonly referred to here as 3C. Further, 3C has to be considered in the context of a further set of three factors. These include the convergence just mentioned, consumerisation of the ICT products, systems and services offered by the industry itself and finally the result of "cloud" computing service offerings on an international scale that brings a global information environment service into being, together nominated in Figure 1 as the "6C" situation..

Roles and Functions of the ICT and Cybersecurity Professional.

Depending upon where an ICT or cybersecurity professional finds their professional practice employed, their responsibility, and thus need to understand the historical background to the discipline, may be tailored as needed. As illustrated in Figure 2, roles played and functions undertaken may vary between activities: * within a traditional ICT vendor, under the usually accepted meaning of the term "ICT industry", as distinct from users or consumers of its products, systems or services but including development of applications for such technologies and artefacts for sale or deployment; * related to the role of an appropriate regulator responsible for associated policy, law and regulation in the cybersecurity realm; and * associated with a responder to attacks on or malfunction of information systems including law enforcement and military entities, internal or external response teams, etc.

3 Structures and People.

The existence of underlying security technologies and systems in any information system can be seen as being related to three distinct aspects, viz. hardware, software and data as in Figure 3. In turn, the historical context of the development of associated security technologies in each of these areas sets the scene for today's product, systems and services offerings. For example, the computer and data network "add-on" security industry is now a very large global activity that, it could be argued, owes its very existence to the failure of the normal ICT industry to provide adequate, proven and reliable security features within the base products it offers. Thus, it is necessary to understand the historical context to the three aspects, again, of any information security product or system. Its functionality specification, its reliable and verifiable implementation in a secure manner itself and, finally, its independent evaluation must be determined by the ICT professional as being fit for the purpose claimed, as illustrated in Figure 4.

Policy, Laws and Regulations.

The cybersecurity professional will be involved in either development of public policy and law/regulations relevant to information systems or responsible for the interpretation and implementation of relevant technologies, products, systems, services, policies and procedures for an owner/manager of that information system or even a combination of both of these. At the extreme end of the "spectrum", the ICT cybersecurity professional may be regarded as a member of the military, involved in cyber operations in response to attack or a member of law enforcement / response teams concerned with investigation of such attacks. In this sense the cybersecurity professional may take on a role of user, manager or professional in the ICT area or be responsible for liaison with people designated in those functions, as illustrated in Figure 5. The question is one of creating appropriate educational curricula to meet these varying situations and requirements. Examples assist in clarifying these concepts. The cybersecurity professional may be responsible for the creation and dissemination of user procedures for use of information system resources in a company, including, for example development and propagation of a bring-your-own-device (BYOD) policy. At the management level, the cybersecurity professional should normally be involved, but often is not, in the requirements definition and procurement activities related to information systems creation and deployment. In this case, for example, some form of labelled "mandatory access control (MAC)" functionality may be favoured over "discretionary access control (DAC)" but this must be specified at procurement time.

The cybersecurity professional must in turn become familiar with the relevant legal and regulatory regimes appropriate to the enterprise involved, including consideration of these parameters at the international, national and industry levels, as in figure 6. a. IEEE/ACM The November 2012 "Ironman" version [8] of the IEEE/ACM's body of knowledge (BOK) definition in the area of "information assurance and security" has been published as document CS2013 as part of the overall computer science curriculum. It acknowledges that the situation in this area is "unique" in that relevant matter overlap with all the other areas defined in the computer science curriculum. It states as follows: "In CS2013, the Information Assurance and Security KA is added to the Body of Knowledge in recognition of the world's reliance on information technology and its critical role in computer science education. Information assurance and security as a domain is the set of controls and processes both technical and policy intended to protect and defend information and information systems by ensuring their availability, integrity, authentication, and confidentiality and providing for nonrepudiation. The concept of assurance also carries an attestation that current and past processes and data are valid. Both assurance and security concepts are needed to ensure a complete perspective. Information assurance and security education, then, includes all efforts to prepare a workforce with the needed knowledge, skills, and abilities to protect our information systems and attest to the assurance of the past and current state of processes and data." However, any historical perspective in this area is separated into an overall "history of computing" section in the BOK. However, the complexity related to inclusion of information assurance curricula into IT programs aimed at the development of the normal IT professional has been a topic of discussion for many years and was clearly alluded to in the earlier ACM IT curriculum guidelines of 2008 [START_REF] Lunt | Information Technology 2008, Curriculum Guidelines for Undergraduate Degree Programs in Information Technology[END_REF]. b. USA -Committee on National Security Systems Documents labelled broadly as "4011" to "4016" set out "training" requirements for various positions in relation to information assurance functions within the USA's Federal Government, Department of Defense and allied organisations [10]. The history of information security gets mentioned but does not receive any detailed analysis of its place in the educational program. c. International Information Systems Security Certifications Consortium (ISC 2 ) -CISSP 3This organisation, established in 1989, has developed a certification program for information security professionals given the "Certified Information Systems Security Professional (CISSP") designation. It has associated with it a "Common Body of Knowledge (CBK)". The process of personal accreditation under the scheme involves study and examination coupled with designated years of experience for various levels of certification, now expanded beyond the original CISSP. The CBK is described by ISC 2 as follows:

"The (ISC)² CBK is a taxonomy -a collection of topics relevant to information security professionals around the world. The (ISC)² CBK establishes a common framework of information security terms and principles which allows information security professionals worldwide to discuss, debate, and resolve matters pertaining to the profession with a common understanding." It sets out a number of domains relevant to the security professional but does not emphasize the historical background to the domains of interest that are set out. d. Universities and Colleges. Many universities and colleges in the USA participate in that country's "National Centers of Academic Excellence (CAE)" program of its National Security Agency and Department of Homeland Security [11]. These educational institutions, however, adhere to the defined CNS and related curricula. In the separate NSA sponsored area of "cyber operations" education a separate curriculum is published with particular emphasis on the data networking arena. Many also participate in the activities of the "Colloquium for Information Systems Security Education (CISSE)4 ", a not for profit society based in Maryland, USA. e. Other Organisations i) ISACA 5This organisation, formerly the Information Systems Audit and Control Association, now just uses its acronym as its name. It also offers a range of industry certifications knows as CISA/CISM/CGEIT/CRISC depending upon an individual's role and certification requirements. In an established manner ISACA publishes its knowledge requirements list as the "2013 Candidate's Guide to the CISM ® Exam and Certification". Once again, while acknowledged, the historical context to the various topics outlined is not given any detailed reasoning or background. Concentration is largely, as may be expected, on the "what" and "how" of the topics.

ii) SANS Institute, EC-Council, CREST (UK) and others. Other industry level organisations also exist to provide information assurance education and training. Once again, however, the concentration is on the "what and how" aspects of cybersecurity with some emphasis on sub-sets of the overall information assurance area, e.g. CREST (UK) which describes itself as follows: " The Council for Registered Ethical Security Testers. CREST exists to serve the needs of a global information security marketplace that increasingly requires the services of a regulated and professional security testing capability."

Conclusions.

A trained cybersecurity technician should be able to readily answer questions related to the "what and how" of any relevant information security matter. However, a cybersecurity professional should be readily able to answer the "Why is it so?" question, the catch-phase of the late Professor Julius Sumner Miller, a prominent physics educator and TV presenter [12]. While numerous industry based education and training groups exist and offer various levels of certification, many of which are accepted by both the private sector and government organisations, including defence related entities, curricula do not emphasize historical background to the topics outlined and thus the "why" of many aspects of information assurance / cybersecurity.

Figure 1 :Figure 2 :

 12 Figure 1: 6C Environment for ICT

Figure 4 :

 4 Figure 4 : Structures relevant to Cybersecurity

Figure 5 :

 5 Figure 5 : People / roles and functions.

Figure 6 :

 6 Figure 6 : Legal and Regulatory Regimes

"The criteria were developed with three objectives in mind: (a) to provide users with a yardstick with which to assess the degree of trust that can be placed in computer systems for the secure processing of classified or other sensitive information; (b) to provide guidance to manufacturers as to what to build into their new, widely-available trusted commercial products in order to satisfy trust requirements for sensitive applications; and (c) to provide a basis for specifying security requirements in acquisition specifications.

One of the authors, Caelli, is a Fellow of ISC 2. .

One of the authors, Caelli, is a member of the Board of CISSE.

One of the authors, Caelli, is an Honorary CISM of ISACA.

Examples here may range for export restrictions on advanced cryptographic systems under the "Wassenaar Arrangement" [START_REF]The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies[END_REF] to industry specific regulations, such as the USA's HIPAA requirements for the healthcare industry at a national level and then to PCI-DSS contractual obligations in the payment card area.

Real Curricula and Industry Training.

At present it appears that full elucidation of the history of information assurance, information security or cybersecurity, under whichever term it may be defined, and the significance of that history in explaining the "why" of current information assurance schemes is severely limited if not totally lacking. For example, the following topics may illustrate the problem:

• "C2 by '92" [START_REF]Computers at Risk: Safe Computing in the Information Age[END_REF] and the failure of mandatory regulations in information assurance in the USA for government/defence procurement; • the Microsoft "Palladium / NGSCB" [START_REF] Levy | The Big Secret: An exclusive first look at Microsoft's ambitious plan to remake the personal computer to ensure security, privacy and intellectual property rights. Will you buy it?[END_REF]


Ronald C Dodge
email: ronald.dodge@usma.edu

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The world that our undergraduates must be prepared to succeed in is changing rapidly. Topics or study areas that seemed critical when a student began his or her undergraduate program may be out of date or encompassed by another emerging topic by the time they graduate. The Association for Computing Machinery and the Institute of Electrical and Electronics Engineers Computer Society (IEEE CS) has a long standing interest in providing input into the educational programs, teaching the future professionals in the field. Since 1968 [START_REF]Recommendations for Academic Programs in Computer Science[END_REF], a joint commission from the two bodies has created a set of curricular recommendations for institutions to use in shaping the Computer Science undergraduate curriculum. This effort has traditionally been fully reviewed every 10 years with a minor interim assessment at the five year mark. The last major review was completed in 2001 and the interim review was completed in 2008. [2] [START_REF]Computer Science Curriculum 221[END_REF] Each new version of the ACM/ IEEE Computing Curriculum provides an opportunity for undergraduate Computer Science programs to review and assess their curriculum against a community constructed set of objectives. The process this year included many changes from previous years, including formally creating a knowledge area for Information Assurance and Security. This new knowledge area is unique among the slate of 18 knowledge areas due to its prevalence throughout all knowledge areas. In this paper, we begin in section two by providing further discussion of the CS2013 process and structure. In section three, we discuss in depth the Information Assurance and Security knowledge area. In section four, we conclude with observations about the general state if institutions capacity to support the security goals of the CS2013 Body of Knowledge.

2

The Joint ACM/ IEEE Computer Science 2013

The ACM and IEEE-Computer Society chartered the CS2013 effort with the following directive:

To review the Joint ACM and IEEE-CS Computer Science volume of Computing Curricula 2001 and the accompanying interim review CS 2008, and develop a revised and enhanced version for the year 2013 that will match the latest developments in the discipline and have lasting impact.

The CS2013 task force will seek input from a diverse audience with the goal of broadening participation in computer science. The report will seek to be international in scope and offer curricular and pedagogical guidance applicable to a wide range of institutions. The process of producing the final report will include multiple opportunities for public consultation and scrutiny

The ACM and IEEE each appointed two co-chairs to manage the process and select the steering committee members. The group began work in the fall of 2010, beginning its work by reviewing the previous ACM/IEEE computing curriculum body of knowledge and preparing a survey to collect and validate existing topics and identify new and emerging requirements. The committee has met approximately every six months in person, supported with monthly teleconferences. The analysis resulted in the committee establishing the following goals:

1. Computer Science curricula should be designed to provide students with the flexibility to work across many disciplines. 2. Computer Science curricula should be designed to prepare graduates for a variety of professions, attracting the full range of talent to the field 3. CS2013 should provide guidance for the expected level of mastery of topics by graduates. 4. CS 2013 must provide realistic, adoptable recommendations that provide guidance and flexibility, allowing curricular designs that are innovative and track recent developments in the field. 5. The CS2013 guidelines must be relevant to a variety of institutions. 6. The size of the essential knowledge must be managed. 7. Computer Science curricula should be designed to prepare graduates to succeed in a rapidly changing field. 8. CS2013 should identify the fundamental skills and knowledge that all computer science graduates should possess while providing the greatest flexibility in selecting topics. 9. CS2013 should provide the greatest flexibility in organizing topics into courses and curricula. 10. The development and review of CS2013 must be broadly based.

The review of the prior bodies of knowledge and the feedback from a survey (described in paragraph 2.1) established the initial set of knowledge areas (KA). In this set of 18 KA's, six new areas emerged. Of particular note is the inclusion of the Information Assurance and Security Knowledge Area (IAS). Each KA was assigned a chair and at least two other committee members. As the subcommittees produced drafts of their Knowledge Areas, others in the community were asked to provide feedback, both through presentations at conferences and direct review requests. The Steering Committee also collected community input through an online review and comment process. The KA subcommittee Chairs (as members of the CS2013 Steering Committee) worked to resolve conflicts, eliminate redundancies and appropriately categorize and cross-reference topics between the various KAs. Thus, the computer science community beyond the Steering Committee played a significant role in shaping the Body of Knowledge throughout the development of CS2013. This two-year process ultimately converged on the version of the Body of Knowledge presented in the IronMan draft. [4]

Survey Input

The development work of creating the initial set of KA's to include in the overall body of knowledge relied heavily on two measures of input; prior ACM/IEEE computer science curriculum work and a survey distributed to institutions worldwide. The purpose of the survey was to gather information on area of knowledge that had either increased or decreased in importance. The survey was sent to over 3500 institutions (1500 in the United States and 2000 internationally), addressed primarily to Computer Science (and related discipline) department chairs and directors of undergraduate studies. The response rate was unfortunately lower than desired (201 responses), however produced valuable input. The respondents represented a wide variety of institution type and size:

• research-oriented universities (55%) • teaching-oriented universities (17.5%) • undergraduate-only colleges (22.5%)

• community colleges (5%)

• less than 1,000 students (6.5%) 77 • 1,000 to 5,000 students (30%) 78 • 5,000 to 10,000 students (19%) 79 • more than 10,000 students (44.5%)

Overview of the CS2013 Body of Knowledge Structure

There are two fundamental concepts for the Body of Knowledge. The first and most fundamental is that the Knowledge Areas *are not* intended to correlate directly to a specific course. The intent is not to imply any restriction on how an institution may desire to address any of the content. The second concept is the tiered approach to describing the importance of given content. The Body of Knowledge is structure hierarchically as shown in Figure 1 Each KA (as listed in paragraph 2), is broken down into sub areas called Knowledge Units. Each Knowledge Unit is described by a collection of topics and related learning outcomes. The learning outcomes are also represented by three degrees of mastery:

• Familiarity: The student understands what a concept is or what it means.

• Usage: The student is able to use or apply a concept in a concrete way.

• Assessment: The student is able to consider a concept from multiple viewpoints and/or justify the selection of a particular approach to solve a problem.

As described earlier, it is expected that topics will span multiple courses. The topics are identified as either core-tier 1, core-tier 2, or elective. The core-tier 1 and core-tier 2 topics are further described by the number of hours that is expected within the undergraduate computer science curriculum. Each hour is reflective of the lecture or supervised learning hours within which the topic is one of the key learning objectives. These hours along with the learning outcomes are intended to provide guidance on the depth of coverage. Understanding that not all programs would or should be alike, the following guidance is provided:

• A curriculum should include all topics in the Tier-1 core and ensure that all students cover this material. • A curriculum should include all or almost all topics in the Tier-2 core and ensure that all students cover the vast majority of this material. • A curriculum should include significant elective material: Covering only "Core" topics is insufficient for a complete curriculum.

A much more detailed discussion of the motivation and philosophy behind the body of knowledge may be found in [4].

CS201Information Assurance and Security Knowledge Area

The Information Assurance and Security Knowledge Area is new in the CS2013 Body of Knowledge. It was clear both in the analysis from the steering committee and the survey results, that the broad range of topics defined by information security are an essential component of any undergraduate computer science program. This new KA was proposed as part of the very first steering committee meeting. During the World Conference on Information Security Education (WISE 7) in June, 2011, organized by an internationally focused IFIP technical working group (WG 11.8), the topic was discussed and further refined to use the title "Information Assurance and Security".

Information assurance has been defined as "a set of controls (technical and policy) intended to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities." [5] [6] This concept of assurance also carries a connotation of an attestation that past processes or data is valid.

Information assurance and security education, then, includes all efforts to prepare a workforce with the needed knowledge, skills, and abilities to assure our information systems and attest to the validity of the current state of processes and data. Information assurance and security education has been growing in importance and activity for the past two decades.

The McCumber model [START_REF] Machonachy | A model for Information Assurance: An Integrated Approach[END_REF] [8] has been widely used over the past 10 years to broadly define the relationships between information states, security services, and security operations (called counter measures in the original model). As the security and assurance landscape has matured, the relationships should be clarified to address that the full spectrum operational aspect of security is not correctly contained by the term counter measures and that emergence of assurance of processes (current and past) is playing a critical role in the field of IAS.

The construction of the IAS KA

The aim of the IAS KA is to define the core (core-tier1 and core-tier2) and elective knowledge threads that depict what a computer science undergraduate should possess upon graduation.

The IAS KA is unique in the collection of KA's due to its pervasive nature in all KA's. One can express this cross cutting impact by comparing security to performance. In the past, many concepts in Computer Science were performance based. Algorithms were developed to increase the performance of memory utilization or database searches. In this light, the way we do things in Computer Science must be done securely. This is not to say that Information Assurance and Security does not have concepts that belong solely to the IAS KA. As shown in table 1, concepts that are unique to IAS are listed with specific core tier 1 and tier 2 hours. Each knowledge unit contains a collection of topics. For the knowledge unit, "IAS/Principles of Secure Design", the topics are shown below. Each topic has an associated learning outcome with a desired level of comprehension (Familiarity, Usage, and Assessment). While we also list the topics associated with the other KU's with the IAS KA, further detail (learning outcomes) and elective topics are left for review in [4]. As detailed below in the Principles of Security Design, the topics document cross reference locations where the referenced topic is also presented in another KA. As an example, the cross reference for the very first topic, "least privilege and isolation" extends to the KA's for Operating Systems, System Fundamentals, and Programming languages. Those references are listed after the Principles of Security Design. The IAS KA is the most heavily cross referenced KA in the CS2013 Body of Knowledge. As can be inferred from the example provided in the preceding paragraph, the relatively small number of recommended curriculum hours is not representative of the presence of IAS topics and concepts in the CS2013 Body of Knowledge. As can be seen in Table 2, while IAS has 9 combined core hours, there are 63.5 hours distributed through the other KA's

IAS/Principles of

Conclusions and Recommendations

The importance of security concepts and topics has emerged as a core requirement in the Computer Science discipline, much like the importance of performance concepts has been for many years. The development of the IronMan draft for the CS2013 computing curriculum has highlighted the emphasis programs are now placing on security topics. This development however has also identified some weaknesses in the capacity institutions have to adequately address the integration of the security. The emerging nature of security is reflected in the challenge of Computer Science programs and faculty with security experience to inculcate the security concepts in the breadth of courses.

•

  AL-Algorithms and Complexity • AR-Architecture and Organization • CN-Computational Science • DS-Discrete Structures • GV-Graphics and Visual Computing • HCI-Human-Computer Interaction • IAS-Information Assurance and Security (new in 2013) • IM-Information Management • IS-Intelligent Systems • NC-Networking and Communication (new in 2013) • OS-Operating Systems • PBD-Platform-based Development (new in 2013) • PD-Parallel and Distributed Computing (new in 2013) • PL-Programming Languages • SDF-Software Development Fundamentals (new in 2013) • SE-Software Engineering • SF-Systems Fundamentals (new in 2013) • SP-Social Issues and Professional Practice

Fig. 1

 1 Fig. 1 Body of Knowledge Structure

  Secure Design [1 Core-Tier1 hours, 1 Core-Tier2 hours] Topics: [Core-Tier1] • Least privilege and isolation (cross-reference OS/Security and Protection/Policy/mechanism separation and SF/Virtualization and Isolation/Rationale for protection and predictable performance and PL/Language Translation and Execution/Memory management) • Fail-safe defaults (cross-reference SE/Software Construction/ Coding practices: techniques, idioms/patterns, mechanisms for building quality programs and SDF/Development Methods/Programming correctness) • Open design (cross-reference SE/Software Evolution/ Software development in the context of large, pre-existing code bases) • End-to-end security (cross reference SF/Reliability through Redundancy/ How errors in-crease the longer the distance between the communicating entities; the end-to-end principle) • Defense in depth • Security by design (cross reference SE/Software Design/System design principles) • Tensions between security and other design goals [Core-Tier 2] • Complete mediation • Use of vetted security components • Economy of mechanism (reducing trusted computing base, minimize attack surface) (cross reference SE/Software Design/System design principles and SE/Software Construction/Development context: "green field" vs. existing code base) • Usable security (cross reference HCI/Foundations/Cognitive models that inform interaction design) • Security composability • Prevention, detection, and deterrence (cross reference SF/Reliability through Redundancy/Distinction between bugs and faults and NC/Reliable Data Delivery/Error control and NC/Reliable Data Delivery/Flow control) Learning outcomes: [Core-Tier1] 1. Describe the principle of least privilege and isolation and apply to system design [application] 2. Understand the principle of fail-safe and deny-by-default [familiarity] 3. Understand not to rely on the secrecy of design for security (but also that open design alone does not imply security) [familiarity] 4. Understand the goals of end-to-end data security [familiarity] 5. Understand the benefits of having multiple layers of defenses [familiarity] 6. Understand that security has to be a consideration from the point of initial design and throughout the lifecycle of a product [familiarity] 7. Understanding that security imposes costs and tradeoffs [familiarity] [Core-Tier2] 8. Describe the concept of mediation and the principle of complete mediation [application] 9. Know to use standard components for security operations, instead of re-inventing fundamentals operations [familiarity] 10. Understand the concept of trusted computing including trusted computing base and attack surface and the principle of minimizing trusted computing base [application] 11. Understand the importance of usability in security mechanism design [familiarity] 12. Understand that security does not compose by default; security issues can arise at boundaries between multiple components [familiarity] 13. Understand the different roles of prevention mechanisms and detection/deterrence mechanisms [familiarity] The cross reference topics that are documented in the first Principles of Security Design topic are: OS/Security and Protection [2 Core-Tier2 hours] Topics: • Overview of system security • Policy/mechanism separation

Table 1 . Information Assurance and Security Knowledge Units/Hours

 1

	Knowledge Unit	Core-Tier1	Core-Tier2 Electives
	IAS/Foundational Concepts in Security	1	-	N
	IAS/Principles of Secure Design	1	1	N
	IAS/Defensive Programming	1	1	Y
	IAS/Threats and Attacks	-	1	N
	IAS/Network Security	-	2	Y
	IAS/Cryptography	-	1	N
	IAS/Web Security	-	-	Y
	IAS/Platform Security	-	-	Y
	IAS/Security Policy and Governance	-	-	Y
	IAS / Digital Forensics	-	-	Y
	IAS/Secure Software Engineering	-	-	Y

Table 2 : IAS Cross KA Hour Distribution

 2 As an example of security topics that are addressed in KA's outside of IAS, System Development Fundamentals contains 10 Core-tier 1 hours that address important security concepts.

	KA's	Core-Tier1	Core-Tier2	Elective
	IAS	3	6	Y
	IAS distributed in other KA's	32	31.5	Y

SDF/Development Methods [10 Core-Tier1 hours]

	• Debugging strategies
	• Documentation and program style
	4
	Topics:
	• Program comprehension
	• Program correctness
	─ Types or errors (syntax, logic, run-time)
	─ The concept of a specification
	─ Defensive programming (e.g. secure coding, exception handling)
	─ Code reviews
	─ Testing fundamentals and test-case generation
	─ Test-driven development
	─ The role and the use of contracts, including pre-and post-conditions
	─ Unit testing
	• Simple refactoring
	• Modern programming environments
	─ Code search
	─ Programming using library components and their APIs


Elena Sitnikova
email: elena.sitnikova@unisa.edu.au

Ernest Foo
email: e.foo@qut.edu.au

Rayford B Vaughn
email: vaughn@research.msstate.edu

The Power of Hands-On Exercises in SCADA Cyber Security Education

Keywords: industrial control systems, SCADA, critical infrastructure, cyber-security, experiential learning, security laboratory, curriculum

For decades Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) have used computers to monitor and control physical processes in many critical industries, including electricity generation, gas pipelines, water distribution, waste treatment, communications and transportation. Increasingly these systems are interconnected with corporate networks via the Internet, making them vulnerable and exposed to the same risks as those experiencing cyber-attacks on a conventional network. Very often SCADA networks services are viewed as a specialty subject, more relevant to engineers than standard IT personnel. Educators from two Australian universities have recognised these cultural issues and highlighted the gap between specialists with SCADA systems engineering skills and the specialists in network security with IT background. This paper describes a learning approach designed to help students to bridge this gap, gain theoretical knowledge of SCADA systems' vulnerabilities to cyber-attacks via experiential learning and acquire practical skills through actively participating in hands-on exercises.

Introduction

Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) are used for remote monitoring and control physical processes in many critical industries including electricity generation, gas pipelines, water distribution, waste treatment, communications and transportation. Increasingly today, these systems are being interconnected with corporate networks via the Internet. This makes them vulnerable and exposes them to the same risks as those experienced in cyber-attacks on a conventional network.

In recent years, research and education in the area of cyber security of ICS and SCADA systems has attracted interest within academic institutions. With the Australian Prime Ministerial directive recently announced by the Hon Julia Gillard and the launch of a new Cyber Security Centre [START_REF] Gillard | Cyber Centre PMC's announcement[END_REF], more researchers will begin to investigate the problem set associated with such systems and their critical roles in monitoring and control of Australian Critical Infrastructures. There is also a high industry demand in cyber security training for ICS and SCADA systems. However, many existing research centres are limited by the lack of testbeds or models capable of representing actual instantiations of ICS applications and an inability to observe an entire SCADA system. The reasons are usually high costs and limited space for such laboratories.

The Idaho National Laboratories (INL) SCADA Testbed Program is a large scale program dedicated to ICS cyber security assessment, standards improvements and training [START_REF]Common Cyber Security Vulnerabilities Observed in Control Systems Assessments by INL NSTB Program[END_REF]. For several years Australian operators of critical industrial control systems have been attending one week training provided by INL in the US. The Australian government Attorney General's Department has subsidised attendance for selected attendees. This training which balances theory and practice is valuable. However from an Australian perspective the benefits are limited, because the time available limits the areas covered and it is a 'one off' opportunity, with substantial costs for the fortunate few attendees. These factors create an urgent need for locally based educational programs which aim to build awareness and relevant skills across the critical infrastructure industries. Local programs would also allow the curriculum to be customised, reflecting specific Australian directives and best practices. It would also cover a broader range of topics and delve more deeply into them. Local training capability also scales up better allowing an increase in the volume of students for a better return on investment. This paper describes the authors' experience in designing and developing hands-on practicals in the two university courses listed below and their value in discovering vulnerabilities in SCADA systems. The cost of travelling overseas to undertake this kind of training is prohibitive, so locally offered courses such as these minimizes expenses and maximizes opportunities for operators to gain critical education in this area. [START_REF] Morris | Advances in the Protection of Critical Infrastructure Improvement in Industrial Control System Security[END_REF][START_REF] Vaughn | Development and Expansion of an Industrial Control System Security Laboratory and an International Research Collaboration[END_REF] and plans for an international research and educational project between the three universities involved, MSU, QUT and UniSA.

The paper is organised as follows. Section 2 describes the needs of education in SCADA and ICS systems and highlights the challenges of educating both IT personnel and SCADA engineers. Section 3 examines tailoring reflective practice and active learning pedagogical approaches. In Sections 4 and 5 we provide details on the practical laboratories that we developed at QUT and UniSA and comment on the value that they provided to the students. Section 6 outlines some benefits, limitations and preliminary findings of how students responded to courses with a focussed on hands-on practical component. We conclude this paper by reviewing our contributions and future work.

The Need

According to an international commentator and INL's infrastructure protection strategist Michael Assante, for managers and engineers responsible for control systems, physical security has always been a priority [START_REF] Assante | Testimony on Securing Critical Infrastructure in the Age of Stuxnet[END_REF]. For many also, IT security is a new field. They have to understand the importance of these systems' cyber security requirements, associated risks and thus deploy proper security measures. Assante in his testimony to the US government on process control security issues, criticises the last decade's considerable body of research in implementing yesterday's general IT security approaches into today's ICS and SCADA systems. He asserts it has "proven ineffective in general IT systems against more advanced threats". He also notes that as more technological advancements are introduced to ICS and SCADA, more complexity and interconnectedness are added to the systems, requiring higher levels of specialty skills to secure such systems. Training managers and process control engineers in the field will help to meet this skills need gap.

Other literature states that SCADA and process control systems vulnerabilities can increase from a lack of communication and/or trust between IT and engineering departments [START_REF] Itseag | Achieving IT Resilience Summary Report for CIOs and CSOs[END_REF]. This is because very often SCADA networks services are viewed as a specialty subject, more for engineers than standard IT personnel. Control system operators are often mistrustful of IT maintainers because ICS has a 24/7 uptime requirement whereas IT maintenance often requires system outages. Previously [START_REF] Slay | Developing SCADA Systems Security Course within a Systems Engineering Program[END_REF][START_REF] Sitnikova | Pathway into a Security Professional: a new Cyber Security[END_REF][START_REF] Sitnikova | Engaging Students through Reflective Practice Assessment within SSLS course[END_REF][START_REF] Foo | A Proposed Australian Industrial Control System Security Curriculum[END_REF] authors have recognised these cultural issues and highlighted the gap between specialists with ICT engineering skills and the specialists in network security with IT background.

The gap between these two disciplines needs to be bridged to recognise, identify and mitigate against vulnerabilities in SCADA and process control systems networks. Broader awareness and the sharing of good practices on SCADA security between utility companies themselves is a key step in beginning to secure Australia's critical Infrastructure.

Industry-trained professionals and qualified learners, today often working in process control services and government organisations, bring to class their fundamentally different skills, objectives and operating philosophies to the concept of security in an enterprise IT context. Thus, the authors are challenged to develop a curriculum that aims to address both discipline-specific engineering and IT issues and bridges the educational gap between IT network specialists and process control engineers, but within the post-graduate cyber security and forensic computing nested programs. To address these issues, the curriculum is designed to accommodate both process control engineers (with no or limited IT skills) and IT specialists (with no or limited engineering skills). This in itself is a difficult balance to achieve.

Learning and Teaching Aspects

Reflective Practice

Our students' diverse skill set has motivated educators at UniSA to implement a reflective practice approach to the hands-on exercises as a part of their assessment task. According to the literature, reflective practice enables students to: 1) understand what they already know; 2) identify what they need to know in order to advance their understanding of the subject; 3) make sense of new information and feedback in the context of their own experience and 4) guide choices for further learning [START_REF] Hinett | Developing Reflective Practice in Legal Education, UK Centre for Legal Education[END_REF]. Considerable literature attests to its benefits. In the mid-late 80s, researchers Kolb, Schon and Boud et al. [START_REF] Kolb | Experiential learning: experience as the source of learning and development[END_REF][START_REF] Schon | Educating the Reflective Practitioner[END_REF][START_REF] Boud | Reflection: turning experience into learning[END_REF] highlighted the major benefit of reflective practice as enabling learners to make sense of their practical experiences and develop critical thinking skills which are essential for decision making and problem solving, especially in the workplace. It has been argued [START_REF] Philip | Encouraging reflective practice amongst students: a direct assessment approach[END_REF] that reflection can be used as a tool to help learners through their studies by encouraging and fostering a deep learning approach. Unlike many other professions and disciplines, especially those in science, health and medicine, that have long adopted this pedagogical practice, engineering and ICT education have only recently begun to adopt this practice [START_REF] Kaider | Introducing undergraduate electrical engineering students to reflective practice[END_REF].

A reflective practice pedagogical approach has been introduced in the COMP 5062 Critical Infrastructure and Process Control Systems Security 4.5 unit course at The University of South Australia. Using well-structured hands-on practical exercises, students experience the technical details of what they have learned from the associated lecture topics. They then reflect on the skills gained, in the form of a written report by the end of the intensive week. Below, we discuss how hands-on practicals are aligned with a 4 step reflective practice process that enables students to

1) understand what they already know;

Prior to the intensive week, students have to complete a brief questionnaire on what they know about SCADA systems security. This allows instructors to identify students' backgrounds, work experience and knowledge in control systems. It also provides information for making informed decisions on how to form groups where diverse skills complement each other's skills to aid collaborative work.

2) identify what they need to know in order to advance understanding of the subject;

This step requires planning intensive week activities to balance theory and practice. Every daily session presents theory to students with active discussion, addressing focussing questions. This gives students knowledge prior to laboratory practicals.

3) make sense of new information and feedback in the context of their own experience;

The Intensive workshop is constructed to be informative and active, with timely feedback and support from instructors. Reflection on new gained knowledge is demonstrated during active participation in group discussions, oral presentations and written reports on the results from practicals.

4) guide choices for further learning

Building on knowledge during the intensive week, students reflect on comments and suggestions provided and then write their further assignment component -a SCADA Security Plan (SSP). The plan takes a form of the academic paper that includes a literature review on the topic and is based not only on theoretical scholarly knowledge, but also on the technical knowledge that students have gained.

QUT educators also implement a reflective practice approach to students' learning. For most of the courses there is an endeavour to ensure that there are three types of sessions. The intent is to provide a theoretical basis for the material, reinforce this with practical application and finally, encourage students to integrate the learning by actively reflecting on the sessions.  The first session is a lecture type session where students are introduced to the theoretical aspects of the material. Students learn where issues fit into the bigger picture. Often, cyber security training courses concentrate on particular vulnerabilities without teaching the background theory. This makes it difficult for students to adapt when faced with a new attack or other scenario.  The second session is a practical hands-on exercise relevant to the topic. Some courses provide only theory or lecture based courses. These are good for awareness issues, but it is not until students successfully complete a hands-on exercise that the impact of the security issue hits home. The use of complex full system hands-on exercises such as a red team, blue team exercise is particularly good at providing an impact to students.  The third 'debrief' session, occurs after the practical session. Here, the course instructor encourages students to discuss the impact of the previous exercise and relate it to their industry experiences. These open discussion sessions allow students to share their insights. Ideally, course instructors arrange for a break between the practical session and the debrief session. This allows students to reflect internally and synthesise the application of the hands on exercise that they have just completed. We have found in previous cyber security courses that the debrief sessions are often described by students as the most useful aspect of the course.

The authors next describe a set of hands-on exercises that are designed to help students to overcome the ICS/IT gap, gain knowledge through experiential learning of SCADA systems vulnerabilities to cyber-attacks and reflect this knowledge by actively participating in hands-on cyber security exercises. As the majority of these students are working and studying part-time, we need to accommodate their needs. To maximise flexibility, availability and convenience, the CICS course is offered to part-time students in online distance study mode (external class) -1 virtual online class per course per week over 12 weeks plus one week half day intensive study in-class per course (15 hours).

Intensive Hands-on Practicals at UniSA

The intensive face-to-face component is not mandatory for external students, but highly recommended. It is a cornerstone of the curriculum and it always occurs in week 4 of the study period. Students from both external and internal classes have an opportunity to attend a face-to-face workshop in Adelaide and participate in handson practicals, guest speakers' presentations and also networking opportunities among peers. During an intensive study week when students attend a half day face-to-face session at Mawson Lakes campus at UniSA, they attend lectures and guest speakers' presentations from industry, police, and law enforcement agencies. Students receive the majority of the course materials and hands-on exercises in class. Exercises are based on operational world situations run by industry practitioners. A brief overview of the intensive week is described in Table 1.

A Continuing Professional Education (CPE) training program at QUT

QUT has developed a Continuing Professional Education (CPE) training program teaching cyber security for industrial control systems. This course is mainly designed for control systems engineers to raise awareness of the impact of cyber attacks on the systems that are under their control. The course also caters to IT security professionals who wish to gain an understanding of control systems and the issues that face control system designers. The course is taught at a postgraduate level, as participants are mainly experienced engineers or IT professionals. Figure 1 (2-4) shows the QUT's laboratory module. The pioneer of the SCADA laboratory was Mississippi State University which first established the lab through support from the US National Security Agency and the US Department of Homeland Security. QUT purchased their lab from the same engineering company used by MSU to insure compatible configurations that will support future research experimentation between the two institutions.

As Control Systems become integrated with IT systems, engineers and IT professionals are now expected to understand the vulnerabilities and threats that affect industrial control systems under their protection. As a result they need to be familiar with general system exploitation techniques and tools that may be used against their system services and applications. This course aims to give an understanding of the fundamental concepts and major issues in the area of industrial control system cyber security. Students will be able to identify critical application and system service vulnerabilities and determine the information security implications of those vulnerabilities upon completion.

The course introduces of a range of techniques for exploiting and mitigating the impact of threats and vulnerabilities to networks and systems. It is important to point out that this course discusses design and testing principles that produce secure applications. During this course techniques and tools are introduced that demonstrate how to exploit system services and applications. Each day of class consists of several information style presentations followed by a relevant practical exercise.

The course is an intensive five-day course delivered in one week. Students must travel to Brisbane to participate. The course has seen representation from students from a wide range of industrial sectors including transport, power, gas and water treatment. Students have travelled from all around Australia to attend the course even though a similar course is held in Western Australia.

The cornerstone of the QUT program is an 8 hour practical exercise. The course participants are divided into a blue team and a red team. The Blue team must defend a corporate network that is connected to a real industrial control system process. The Red team must attack and disrupt the industrial process. The QUT program employs small scale industrial process systems that use industrial PLCs to control them. These systems are also used to conduct research in the area of industrial control system vulnerabilities and the testing of mitigation strategies.

The following is a brief overview of day to day content included in the QUT's five-day course (Table 2) The fourth day of the course is the key learning event for the course. The Red Blue team exercise is an eight hour event where the blue team must defend their industrial process from the red team.

Day
The fifth day is a closing day where the students reflect on the week they have completed. Student from the red team and blue team give presentations that reflect on the processes and incidents that occurred in the Day 4 exercise. The instructors conclude the day by emphasising key points, as well as revealing any components of the Red Blue Team exercise that could have been handled better by the respective teams.

Discussions

Experience on running of hands-on practicals and the lessons we have learned could be categorised as benefits, limitations and observations.

Benefits. IT personnel together with control systems engineers have to encounter non-standard IT systems and learn how to protect SCADA and ICS and make them less vulnerable to cyber-attacks.

Limitations. Unlike QUT, UniSA does not have its own laboratory. For this reason academics rely on local industry practitioners to design, establish and run the lab once a year for a week. UniSA provides licences for required software, but hardware equipment is generously provided by industry collaborators.

Observations. At UniSA Students demonstrated good results (grades for hands-on practicals), they also summarised and reflected on what learned during the week during their oral presentations in class, but they were informally assessed by educators and fellow students. It would be better to include this activity in a formal submission with appropriate weighting.

One of the major goals of the is the applicability of knowledge gained to students' work environments. We received positive feedback from students to this effect: "It's been so much more than I expected -a good balance of technical along with practical skills that will hopefully help me gain employment" (Student #1, 2011, Adelaide)

"The subject matter covered throughout the course was generally directly relevant to the industry I work in. The assignments were very helpful and relevant. Data collected during the first assignment and the report generated as part of the second assignment was able to link directly with issue within my own enterprise and been able to submit internally within the enterprise for further action". (Student #2, 2011, Adelaide)

QUT Course Structure

The QUT training course has its origins in coursework adapted from normal coursework security classes that are offered to postgraduates and undergraduates. As a result the lecture presentations were quite theoretical and lengthy. There has been a concerted effort to streamline these presentations and to allow more time for students to explore and experiment in the practical exercises associated with each topic. This is also important for preparing students for the Day 4 Red/ Blue Team exercise.

Course Content

The content of the QUT training course is based on several classes that make up the undergraduate and postgraduate degree courses. This content previously had a strong focus on web vulnerabilities. While this has been very educational and interesting for students, the relevance to industrial control systems is less clear. It should be noted that some industrial control systems do employ a web interface. There are other relevant areas of security that have been previously omitted from early courses because of time constraints. These topics, such as the effect of social engineering and phishing attacks will be included in the next iteration. Also, basic introductions to malware functionality, operation and analysis will be included. These two main topics are more relevant to control system engineers, as they are the threat most likely to be encountered in their daily operations.

Red/Blue Team Exercise

The QUT course development team spent a large amount of time and effort in creating the Red/Blue Team exercise on the 4th day of the course, aiming to produce an environment as detailed and as realistic as possible. This complexity enables students to immerse themselves in the scenario and really invest in their tasks. Overall this has been a great success, with some students becoming too emotionally involved in the scenario. The many ingredients include a realistic corporate network and DMZ, physical separation of red and blue teams into their own areas, CCTV monitoring systems and localized VOIP communications. One of the key areas that has added to the realism of the exercise is the use of real control systems, combined to produce an industrial process that the Blue team must monitor and operate throughout the day. A complex sequence of events must be completed for one instance of the process to be completed. The Blue team is rewarded with points for every time the sequence is completed. The industrial process involves three of the simulators available at the QUT SCADA security research laboratory. These include a water reservoir, conveyer system, and gas pressure system.

While the Red/Blue Team exercise was successful, aspects of the exercise can be improved. Besides fixing bugs in the system, it is important that both teams are monitored closely. We employed CCTV cameras to monitor the teams as well as network monitoring software, to ensure that Blue team servers continued to function. However the QUT development team realized that a closer monitoring of the network is required, in particular the monitoring of password changes by both the attacking and defending team. In the next course iteration, custom software will be used to monitor password files.

Another important aspect for the Red/Blue team exercise that links with monitoring students is that organisers should ensure that scripted events occur during the 8 hour length of the exercise. The Red Team should not be able to beat the Blue team in the first hour, but should not be stuck for hours on a particular problem either. The Red Team should have to meet a set of achievable goals within certain time restrictions. These do not necessarily need to match or oppose the goals of the Blue team. For example the Red team can be tasked with exfiltrating company secrets while the Blue team's main goal is maintaining the industrial process. Contingencies should be made by the course organizers to ensure that key learning outcomes are made for both the Red and Blue teams equally.

One option for running the Red/Blue exercise is to only have students participate as part of the Blue team as that is where industry will require them to operate. However since the teaching staff have set up the exercises and know all the avenues to access the Blue team network, the exercise would seem too artificial to the students. Ideally, past students should be invited back to play different roles such as the Red Team if they have participated originally as the Blue team. However this scenario is currently difficult, because students travel from all over Australia. It might be possible if the exercise were offered to local students in other award courses such as a Bachelors or Masters degree.

Experiences at UniSA and QUT have shown that large complex practical exercises for cyber security training have a deep impact on students' learning, enabling students to reflect on newly learnt theory and apply new skills and insights to following assignments and later to their workplaces.

Conclusion and Future Work

This paper has described two courses developed in two Australian universitiesthe University of South Australia (UniSA) and the Queensland University of Technology (QUT). From an Australian perspective, our work in developing courses in SCADA systems security aims to educate locally SCADA practitioners with engineering backgrounds and ICT personnel.. Establishing a local facility both to provide training and research into industrial control systems security should have substantial benefit. Establishing these course curriculum and practical laboratories in Australia gives more opportunity for local systems owners and operators to provide feedback so that local conditions can be more easily taken into account.

Another aim is a collaborative effort of two Australian universities -University of South Australia (UniSA) and Queensland Institute of Technology (QUT) towards an international project with Mississippi State University (MSU) in the United States. Plans are underway to engage our respective students in this project which will attempt to implement a trans-Pacific red team/blue team exercise.

Our future plans include expanding our research and education in the area of SCADA and ICS security by developing  an external penetration hands-on exercise from the UniSA to a QUT laboratory;

 a remote vulnerability testing between laboratories in Australia (QUT) and United States ( MSU);

 a working simulation model of ICS that provides accurate responses to sets of inputs (thus allowing some research experimentation to take place without using a physical laboratory)

Figure 1 .

 1 Figure 1. A SCADA Traffic Control System Lab at UniSA (1), Pipeline, Smart Meter and Conveyer Laboratory Simulators at QUT (2-4).



  COMP 5062 Critical Infrastructure and Process Control Systems Security (Masters level) course at the University of South Australia (UniSA) o At UniSA, hands-on practicals are presented during a one week intensive study workshop that balances the content of lectures with hands-on practicals delivered in our security laboratory set up temporarily on equipment provided by industry collaborators.  Cyber-security 5 days training at the Queensland institute of Technology (QUT) o At QUT, the curriculum for a 5 day Cyber-security training is focused on providing education and local training for professionals working in the control system industry, as well as for graduates hoping to enter the field. By way of background, researchers at both UniSA and QUT established a cross-institutional collaboration in 2011 when they first met at the Idaho INL training facilities. This initial connection was expanded internationally through strong collaborations with Mississippi State University (MSU) in the United States. This involved exchanges of faculty members, the establishment of SCADA laboratory facilities at QUT similar to the MSU laboratory and the exchange of virtual SCADA testbed software with UniSA. This collaboration has already resulted in several joint papers in the field

  UniSA has developed a new Master of Science (Cyber Security and Forensic Computing) one and a half year full time equivalent program. It offers a pathway through a suite of nested programs including Graduate Certificates, a Graduate Diploma, Masters and possible continuation into PhD level program. These are designed to attract a diverse group of learners traditionally coming from two cohorts of industry practitioners: one with engineering (SCADA practitioners) and the other (ICT personnel) with IT background. It also enables industry-trained and qualified learners without undergraduate degrees, to gain the security qualification required though their access to tertiary study[START_REF] Sitnikova | Pathway into a Security Professional: a new Cyber Security[END_REF]. Within the program students have to complete eight core courses before they study a Minor Thesis 1 and 2. The COMP 5062 Critical Infrastructure and Control Systems Security course is one of the eight courses the program offers.

Table 1 .

 1 A brief overview of the intensive week at UniSA.

		Day 1	Day 2	Day 3	Day 4	Day 5
	Short	SCADA control	SCADA Specific
	Lecture	systems fundamentals	Protocols Modbus
			and DNP3
	Practical	Programming and	Modbus	SCADA	SCADA
	Lab	testing of PLC.	Communications	Vulnerability	Vulnerability
				assessment	assessment
				Part 1	Part 2
	Lab	Virtual machine pre-	Virtual machine	System is	System
	Configura	installed with PLC	pre-installed with	deliberately	configured to be	Recap
	tions	programming	ModScan, MovServ	configured to be	less vulnerable	and the
		software with	software; Hex	highly	with network in a	summary
		emulation ability;	editor; Wireshark	vulnerable with	"good" condition.
		HMI programming	open source ; Hyper	network in a	Tasks included:	Students
		software with runtime	Terminal	"bad" condition.	blue/red team	present on
		ability, SCADA	communication	Different	exercise with red	what they
		development and	software; serial port	platforms are	as attackers and	have
		runtime software.	capture, Modbus	used (NT3.5,	blue as defenders.	learned
			RTU parser	NT4, Win98)	Students are	during
				with un-patched	provided with	intensive
				software	Backtrack	week.
				installed	software.	During
	Task	Students have to	Students study	The Blue/Red	The Blue/Red	this
		write a PLC program	Modbus RTU and	team exercise	team exercise	session
		starting from a single	Modbus TCP serial	with red as	with Red as	students
		traffic light operation,	packets using	attackers and	attackers and Blue	reflect on
		adding later multiply	ModScan and	blue as	as defenders.	the
		traffic lights and	ModSim; forming	defenders of the	Students are	knowledg
		include pedestrian	of a Modbus packet	traffic control	provided with	e	they
		lights and extending	to inject and	system (Fig.1).	Backtrack	have
		PLC program to	manipulate of the	Students are	software.	gained
		include external	traffic PLC.	provided with		during the
		control for		Backtrack		week.
		emergency such as		software.
		fire and ambulance.
		With SCADA
		running and its
		graphical control
		through HMI,
		students have
		exposure to detect
		PLC faults and fix
		them to ensure
		SCADA operates in
		correct way.
	Assessme	Worksheet	Worksheet	Group	Group
	nt	completion with the	completion with the	presentations	presentations and
		comments /solutions	comments	and discussions	discussions on
		demonstrated	/solutions provided	on Day 5	Day 5

Table 2 .

 2 A brief overview of the content of the CPE training program at QUT.

Acknowledgements

The authors would like to acknowledge Mr Cameron Sands and Mr Ben McInerney of AutomateNow for their assistance in developing hands-on exercises for COMP 5062 course intensive week practicals at UniSA described in this paper and Dr Patricia Kelly from UniSA for editorial advice.