SaTC: EDU: Transdisciplinary Cybersecurity Education for Law and Engineering Students

虽然网络攻击和防御本质上是技术性的，但法律和监管环境决定了它们构成的风险和可用的应对措施。因此，迫切需要培训未来的网络安全专业人员的技术IT技能以及相关的法律和政策问题。此外，拥有具有足够技术知识的法律专业人员与网络安全同行合作是至关重要的。该项目将设计并实施一个网络安全教育框架，该框架将法律和工程专业的学生整合到一个教室中，并训练他们评估和应对现实场景。目标是为学生提供跨多个维度的网络安全问题的整体视图，并为他们制定新的对策，法规和政策做好准备。由此产生的课程将提供给其他机构，以便采用这种方法并提供类似的教育和培训项目。该项目将为法律和工程专业的学生开发一门基于场景的网络安全课程，其努力包括(i)在虚拟机环境中实施网络安全场景，（ii）开发有关安全和隐私法规、数据管辖权和数据治理的法律问题模块，以及（iii）开发跨学科互动课程。这七个网络安全场景将包括软件、硬件、数据和网络以及社会工程层面的网络攻击。这些场景还将涵盖广泛的法律和政策问题，包括数据泄露通知法、何时披露漏洞的法律分析、解决低级别网络犯罪的挑战、执法的限制以及合规的法律和道德问题。项目团队的目标是通过开发开源教科书来促进这种跨学科方法的采用，其中将包括文档完备的软硬件平台和网络安全场景。该项目由安全与可信网络空间（SaTC）计划支持，该计划资助解决网络安全和隐私问题的提案，在这种情况下，特别是网络安全教育。SaTC项目与《联邦网络安全研究与发展战略计划》和《国家隐私研究战略》保持一致，旨在保护和维护网络系统日益增长的社会和经济效益，同时确保安全和隐私。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

While cyberattacks and defenses are technical in nature, the legal and regulatory environment shapes both the risks they pose and the responses available. As a result, there is an urgent need to train future cybersecurity professionals in the technical IT skills as well as the relevant legal and policy issues. In addition, it is critical to have legal professionals with sufficient technical knowledge to work with their cybersecurity counterparts. This project will design and implement a cybersecurity education framework that integrates law and engineering students in a single classroom and trains them to assess and respond to real-life scenarios. The objective is to provide students with a holistic view of cybersecurity issues across multiple dimensions and to prepare them to develop new countermeasures, regulations, and policies. The resulting curriculum will be made available so that other institutions can adapt the approach and provide similar education and training programs.This project will develop a scenario-based cybersecurity course for both law and engineering students, with the effort including (i) implementing the cybersecurity scenarios on a virtual machine environment, (ii) developing modules on legal issues concerning security and privacy regulations, jurisdiction over data, and data governance, and (iii) developing transdisciplinary interaction sessions. The seven cybersecurity scenarios will include cyberattacks at the level of software, hardware, data and networks, and social engineering. These scenarios will also cover a wide range of legal and policy issues including data breach notification laws, legal analysis of when to disclose vulnerabilities, challenges in addressing low-level cybercrime, limits of law enforcement, and legal and ethical issues in compliance. The project team’s objective is to facilitate adoption of this transdisciplinary approach by developing an open-source textbook, which will include well-documented software-hardware platforms and cybersecurity scenarios.This project is supported by the Secure and Trustworthy Cyberspace (SaTC) program, which funds proposals that address cybersecurity and privacy, and in this case specifically cybersecurity education. The SaTC program aligns with the Federal Cybersecurity Research and Development Strategic Plan and the National Privacy Research Strategy to protect and preserve the growing social and economic benefits of cyber systems while ensuring security and privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.