The SFS summer research study at UMBC: Project-based learning inspires cybersecurity students

Abstract

May 30-June 2, 2017, Scholarship for Service (SFS) scholars at the University of Maryland, Baltimore County (UMBC) analyzed the security of a targeted aspect of the UMBC computer systems. During this hands-on study, with complete access to source code, students identified vulnerabilities, devised and implemented exploits, and suggested mitigations. As part of a pioneering program at UMBC to extend SFS scholarships to community colleges, the study helped initiate six students from two nearby community colleges, who transferred to UMBC in fall 2017 to complete their four-year degrees in computer science and information systems.The study examined the security of a set of "NetAdmin" custom scripts that enable UMBC faculty and staff to open the UMBC firewall to allow external access to machines they control for research purposes. Students discovered vulnerabilities stemming from weak architectural design, record overflow, and failure to sanitize inputs properly. For example, they implemented a record-overflow and code-injection exploit that exfiltrated the vital API key of the UMBC firewall.This report summarizes student activities and findings, and reflects on lessons learned for students, educators, and system administrators. Our students found the collaborative experience inspirational; students and educators appreciated the authentic case study; and IT administrators gained access to future employees and received free recommendations for improving the security of their systems. We hope that other universities can benefit from our motivational and educational strategy of teaming educators and system administrators to engage students in active project-based learning centering on focused questions about their university computer systems.During four summer days in 2017, cybersecurity students at the University of Maryland, Baltimore County (UMBC) analyzed the security of a targeted aspect of their university computer systems. We report on this novel summer research study, its technical findings, and takeaways for students, educators, and system administrators.In fall 2016, UMBC was one of ten schools that pioneered a new strategy for attracting talented cybersecurity professionals into government service: extend CyberCorps: Scholarship for Service (SFS) scholarships to nearby partnering community colleges (CCs). There are outstanding students at CCs, and for many of them the financial challenges of attending a four-year college full-time are daunting. With support from the National Science Foundation (NSF), UMBC offered six students the following contract: after completing an associate's degree, transfer to UMBC and complete a bachelor's degree in a cybersecurityrelated major. In return for three years of generous support (tuition, fees, health insurance, stipend, and more) starting in the last year of CC, students work for government (federal, state, local, or tribal) for each year of support. UMBC inducted three students from Montgomery College (MC) and three from Prince George's Community College (PGCC), who all ...

Untitled

“…CL is one way to facilitate students so that students are able to gain meaningful knowledge and experience in achieving learning goals. Several previous studies have been conducted, PBL is proven to be able to improve the quality of student learning outcomes through collaboration to produce learning projects (Moghaddas & Khoshsaligheh, 2019;Sherman et al, 2019). This PBL method equips students to have the skills that are needed at this time.…”

Shadow IT in higher education: survey and case study for cybersecurity

“…This five-day UMBC case study-the fourth in a series organized by Sherman [11,35,36]-illustrates how easily shadow IT can grow and expand throughout an organization and how it can create vulnerabilities. Institutions of higher learning, with independent sources of funding available through grants and a mindset of autonomy, are especially vulnerable to the dangers of shadow IT.…”

“…The study also illustrates how shadow IT arises to satisfy an unmet need. This research study was the fourth in a series organized by Sherman [11,35,36] to inspire students through authentic project-based learning.…”

Project-based learning continues to inspire cybersecurity students

“…In 2017, students analyzed the NetAdmin custom scripts that enable faculty and staff to open the UMBC firewall to permit external access to machines they control on the research subnet [5,6]. In 2018, students analyzed the WebAdmin custom software that UMBC students, faculty, and staff use to manage credentials and accounts.…”