Collaborative Research: Active-Learning Laboratory Experiments for Teaching IT Security

为加强大学生资讯科技教育的保安成分，本计划透过全面研究电脑及网络保安的原理、知识、最新研究成果、先进技术及工具，建立一套实作的资讯科技保安实验室。这些实验的主题包括漏洞评估、网络访问保护、防火墙、入侵检测和防御系统、安全审计和监控、加密系统、证书服务和公钥基础设施、虚拟专用网、密码管理和系统加固。通过分层和模块化的设计，实验可以根据不同的课程和不同的环境进行最小的修改。在不影响实验教学目标的前提下，通过“即插即用”的方式增加新技术、新产品，删除旧工具。在现有的虚拟实验室环境中开发了基于云的试验台，并在该试验台上对实验室进行了测试。来自工业界的外部顾问帮助评估这些实验的内容和形式。透过这些实践活动，学生可亲身接触资讯科技保安领域的实际问题，并有机会从先进科技和先进工具的经验中学习。研究结果透过指定的门户网站、工作坊、研讨会和刊物广泛传播，以协助其他大学和学院的讲师更有效地准备和讲授资讯科技保安课程。

In order to enhance the security component in undergraduate IT education, this project develops a suite of hands-on IT security labs through comprehensive studies on the principles, knowledge, recent research results, advanced technologies and tools in the fields of computer and network security. The topics of these experiments include vulnerability assessment, network access protection, firewall, intrusion detection and prevention systems, security audit and monitoring, cryptographic systems, certificate service and public-key infrastructure, virtual private networks, password management and system hardening. With a layered and modular design, the experiments can be tailored with minimal modification by instructors for use in different courses and various environments. New technologies and products can be added and obsolete tools can be removed in a "plug-and-play" manner without affecting the teaching objective of an experiment. A cloud-based test-bed is developed in an existing virtual laboratory environment and the labs are tested in this test-bed. External consultants from industry help evaluate the contents and format of these experiments. Through these hands-on activities, students are provided with an active-learning environment by exposing them to real-world problems in the field of IT security and the opportunity to learn from experiences with advanced technologies and well developed tools. The research results are being widely disseminated through a designated web portal, workshops, seminars and publications to help instructors from other universities and colleges prepare and deliver IT security courses more effectively and efficiently.