Collaborative Research: Active-Learning Laboratory Experiments for Teaching IT Security

为了加强本科IT教育中的安全部分，本项目通过对计算机和网络安全领域的原理、知识、最新研究成果、先进技术和工具的全面研究，开发了一套实践IT安全实验室。这些实验的主题包括脆弱性评估、网络访问保护、防火墙、入侵检测和预防系统、安全审计和监测、密码系统、证书服务和公共密钥基础设施、虚拟专用网络、密码管理和系统强化。通过分层和模块化设计，教师可以在最小的修改下定制实验，以用于不同的课程和各种环境。在不影响实验教学目标的前提下，可以“即插即用”的方式增加新技术和产品，删除过时的工具。在现有的虚拟实验室环境中开发了一个基于云的测试平台，并在该测试平台上对实验室进行了测试。来自行业的外部顾问帮助评估这些实验的内容和形式。通过这些实践活动，学生们通过接触IT安全领域的实际问题，并有机会从先进技术和开发良好的工具的经验中学习，为他们提供了一个积极的学习环境。研究结果正透过指定的入门网站、工作坊、研讨会及刊物广泛传播，以协助其他大专院校的导师更有效地准备及教授资讯科技保安课程。

In order to enhance the security component in undergraduate IT education, this project develops a suite of hands-on IT security labs through comprehensive studies on the principles, knowledge, recent research results, advanced technologies and tools in the fields of computer and network security. The topics of these experiments include vulnerability assessment, network access protection, firewall, intrusion detection and prevention systems, security audit and monitoring, cryptographic systems, certificate service and public-key infrastructure, virtual private networks, password management and system hardening. With a layered and modular design, the experiments can be tailored with minimal modification by instructors for use in different courses and various environments. New technologies and products can be added and obsolete tools can be removed in a "plug-and-play" manner without affecting the teaching objective of an experiment. A cloud-based test-bed is developed in an existing virtual laboratory environment and the labs are tested in this test-bed. External consultants from industry help evaluate the contents and format of these experiments. Through these hands-on activities, students are provided with an active-learning environment by exposing them to real-world problems in the field of IT security and the opportunity to learn from experiences with advanced technologies and well developed tools. The research results are being widely disseminated through a designated web portal, workshops, seminars and publications to help instructors from other universities and colleges prepare and deliver IT security courses more effectively and efficiently.