EDU: Collaborative: Educating the Security Workforce through On-Demand Live Competitions

EDU：协作：通过点播现场竞赛教育安全人员

• 批准号: 1623269
• 负责人: Adam Doupe
• 金额: $ 15.46万
• 依托单位: Arizona State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2018-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1623269&HistoricalAwards=false
• 关键词: EDU; Collaborative; Educating; Security; Workforce

The United States is facing a cyber-security crisis. Recent studies predict a shortfall of 1.5M global information security jobs by 2020. The lack of qualified cyber-security workforce gives rise to high-profile security incidents. In addition, attacks against the nation's critical infrastructure can have devastating effect that go well beyond the financial losses that we are witnessing today. Example targets include aviation control software, the power grid, and even the networks themselves, with the advent of new and emerging network-centric technologies such as software-defined networks. Therefore, it is crucial to educate the next generation of cyber-security professionals. Cyber-security exercises, in which students analyze software to discover flaws and mitigate them, are an excellent instructional method to effectively improve the security skills of protection, detection, and response.Security training requires that developers acquire both the skills necessary to find security vulnerabilities in software, as well as the skills to fix existing flawed software. The knowledge that comes from studying vulnerabilities and vulnerability patterns provides students with the hands-on expertise to complement theoretical security skills. Live cyber-security exercises are an excellent tool to teach and reinforce security concepts in students. However, live cyber-security competitions place a significant time and effort burden on the organizers, because as soon as an intentionally-vulnerable software is used in a competition it cannot be used again. Therefore, all the time and effort spent creating the intentionally-vulnerable software is used on a single competition. In addition, running a live cyber-security competition requires technical skills (e.g., networking and server administration) that may be outside the expertise of educators. This project allows any educator or student, regardless of their technical skills, to host their own security competition. In addition, the participants will be able to create the intentionally-vulnerable software, which stimulates creativity and constructive behavior. Finally, this project will develop a repository of intentionally-vulnerable software, which allows educators to select sample vulnerable software from different vulnerability classes, furthering the educational goals of the instructor.

美国正面临网络安全危机。最近的研究预测，到 2020 年，全球信息安全岗位将短缺 150 万个。合格的网络安全劳动力的缺乏导致了备受瞩目的安全事件。此外，针对国家关键基础设施的攻击可能会造成破坏性影响，其影响远远超出我们今天所目睹的经济损失。示例目标包括航空控制软件、电网，甚至网络本身，以及新兴的以网络为中心的技术（例如软件定义网络）的出现。因此，教育下一代网络安全专业人员至关重要。网络安全练习是学生分析软件以发现缺陷并减轻缺陷的一种很好的教学方法，可以有效提高保护、检测和响应的安全技能。安全培训要求开发人员既掌握发现软件中安全漏洞所需的技能，又掌握修复现有缺陷软件的技能。通过研究漏洞和漏洞模式获得的知识为学生提供了实践专业知识，以补充理论安全技能。现场网络安全练习是教授和强化学生安全概念的绝佳工具。然而，现场网络安全竞赛给组织者带来了巨大的时间和精力负担，因为一旦在比赛中使用了故意存在漏洞的软件，就无法再次使用。因此，创建故意存在漏洞的软件所花费的所有时间和精力都用在了一次竞赛上。此外，举办现场网络安全竞赛需要技术技能（例如网络和服务器管理），这可能超出了教育工作者的专业知识。该项目允许任何教育者或学生，无论其技术技能如何，都可以举办自己的安全竞赛。此外，参与者将能够创建故意易受攻击的软件，从而激发创造力和建设性行为。最后，该项目将开发一个故意存在漏洞的软件存储库，允许教育工作者从不同的漏洞类别中选择易受攻击的软件样本，从而进一步实现教师的教育目标。