SaTC-EDU: EAGER: Enhancing Cybersecurity Education through Peer Review

同行评议是一个众所周知的过程，通过这个过程，同行们会评估彼此的工作。在教育环境中，同侪评议涉及学生评价同学的作业。同行评议有许多教育目的：它们培养理解能力（学生阅读他人的作品），鼓励自我评估和元反思（学生将自己的解决方案与他人的解决方案进行对比），要求从多个角度综合评论（学生将来自多个评论的反馈结合起来），并培养在给予和接受同事批评方面的专业技能。教育同行评审试图培养的技能在网络安全中是至关重要的：代码评审是现代工业软件实践的一部分（并且已经确定了引人注目的安全漏洞），安全问题是多方面的，需要能够综合许多利益相关者需求的开发人员，开发人员必须优先考虑通过不同来源和过程确定的漏洞。同行评议强调培养学生的反思能力，因此有望成为培训安全专业人员的宝贵机制。然而，同行评议有很多种形式，每一种都可以以不同的方式吸引学生。因此，将同行评议配置与网络安全学习成果联系起来的教育研究对于有效利用这一机制至关重要。该项目将在各种网络安全课程中尝试同行评审配置。这些课程涵盖了网络安全的几个领域（软件、系统和政策），本科生和研究生都可以参加。该项目将探索各种网络安全特定学习目标如何通过同行评审体现出来。它还将产生用于跨各种课程和配置使用和评估同行评审的软件基础结构。该项目的预期交付成果包括对学生评审实践的观察，关于如何在安全教育中成功使用同行评审的精炼研究问题，以及其他人可以用于类似项目的软件工具（将公开提供）。

Peer-review is a well-known process by which peers evaluate one another's work. In educational settings, peer review involves students evaluating the work of classmates. Peer evaluations can serve many educational purposes: they foster comprehension skills (as students read the work of others), encourage self-assessment and meta-reflection (as students contrast their solutions to others'), demand synthesis of comments from multiple perspectives (as students combine feedback from multiple reviews), and develop professional skills around giving and receiving critique from colleagues.The skills that educational peer review attempts to foster are critical in cybersecurity: code review is part of modern industrial software practice (and has identified high-profile security bugs), security problems are multi-faceted and require developers who can synthesize needs of many stakeholders, and developers must prioritize among vulnerabilities identified through different sources and processes. Peer review, with its emphasis on developing students' reflective skills, thus promises to be a valuable mechanism in training security professionals. There are, however, many configurations of peer review, each of which could engage students in different ways. Educational research focused on linking peer review configurations to learning outcomes in cybersecurity is thus critical to using this mechanism effectively.This project will experiment with peer-review configurations in a variety of cybersecurity courses. The courses span several areas of cybersecurity (software, system, and policy), as well as both undergraduate and graduate students. The project will explore how various cybersecurity-specific learning objectives manifest through peer review. It will also yield software infrastructure for using and assessing peer review across a variety of courses and configurations. Expected deliverables from the project include observations about students' reviewing practices, refined research questions about how to use peer-review successfully in security education, and software tools that others can use for similar projects (which will be made publicly available).