Popular in Professional

Culture and Society

The City as a Growth Machine: Toward a Political Economy of Place

New York University Harvey Moltoch

Education

The Role of Education in Reducing Racial Inequality

University of Southern California Pedro A. Noguera

Law

Diversity and Social Mobility in the UK legal profession

Law Society I. Stephanie Boyce

Internet Law

The Law of AI for Good

University of San Diego Orly Lobel

Pharmacy

Cytotoxic Activity and Anti-Migratory Effect of Berberine-Phytantriol Liquid Crystalline on Non-Small-Cell Lung Cancer

University of Technology Sydney Kamal Dua

Human Rights Law

Transforming Restorative Justice for Transitional Settings

University of Nottingham Kerry Clamp

Education

“Hacking an IoT Home”: New opportunities for cyber security education combining remote learning with cyber-physical systems

View more insights in Professional - Education - STEM Education

View more figures from University of the West of England

View the page of Phil Legg

Read the Study

· Tools Cite Embed

Phil Legg discusses the teaching of cybersecurity in the age of remote learning. Innovative approach using home IoT devices for interactive learning.

Image courtesy of interviewee. January 12, 2024

Log-in or Sign-up to Faculti
Currently viewing this subject insight as a guest. You have insight(s) remaining for this month.

Workspace

Faculti AI is thinking...

< >

Summary
Related Studies
Faculti AI
Key Points
Key Quotes
Translate
Transcript

Export as PDF

This video video describes a project focused on improving cybersecurity education, particularly in home environments, and adapting to challenges posed by the COVID-19 pandemic. With many people working from home and using connected devices, the project aimed to educate individuals about the security implications of these devices. The initiative involved creating an Internet of Things (IoT) home setup filled with various smart devices (like cameras, doorbells, and appliances) and linking them to a "capture the flag" platform for educational purposes.

During the project, students engaged in challenges that allowed them to remotely control the devices in a demonstrative way— such as making light bulbs flash, activating fans, and triggering a vacuum cleaner through their solved tasks. This video video hands-on, remote interaction emphasized the growing importance of understanding cybersecurity in a digital and connected world. The key takeaway for students was recognizing the real-world impact their actions from different geographical locations could have on a remote environment.

The project also highlighted the need to rethink traditional approaches to cybersecurity education, moving away from solely classroom-based learning to embracing remote, practical experiences that reflect the realities of today's technology. Overall, it aimed to balance security and convenience in technology use, emphasizing risk management, understanding vulnerabilities, and the significance of individual decision-making in cybersecurity practices.

Language:

Export as PDF

X-TIMESTAMP-MAP:LOCAL=00:00:00.000,MPEGTS=900000

00:00.235 --> 00:04.205
Here in this project, what we've been looking at is how to

00:05.115 --> 00:07.805
help people understand cybersecurity

00:08.505 --> 00:11.565
and what in particular with this project,

00:11.785 --> 00:13.405
we were looking at the home environment,

00:13.545 --> 00:18.325
and this became really important obviously with the pandemic

00:18.745 --> 00:22.285
and COVID-19, we had a lot of plans in terms

00:22.505 --> 00:23.965
of schools' outreach

00:24.025 --> 00:26.645
and work with the communities to,

00:27.275 --> 00:28.685
upskill in cybersecurity,

00:29.265 --> 00:31.165
and a lot of those plans got put on hold.

00:32.065 --> 00:34.765
So this was then taken a view of, well, a lot

00:34.765 --> 00:36.685
of people are at home, A lot of people have

00:37.195 --> 00:39.805
connected devices in their homes, so

00:39.825 --> 00:43.565
how can we help people understand the connectivity

00:43.585 --> 00:46.205
of those devices and the security implications

00:46.235 --> 00:47.365
that come with that?

00:48.265 --> 00:52.305
So in this project, we were looking at having

00:52.405 --> 00:53.425
an iot home.

00:53.485 --> 00:57.505
So in internet of things, devices such as smart cameras,

00:58.075 --> 01:01.665
smart doorbells, all the way through to things like,

01:01.845 --> 01:04.945
vacuum cleaners, dishwashers, et cetera,

01:06.305 --> 01:07.885
and thinking, well, how could,

01:08.225 --> 01:09.965
how could we educate about the fact

01:09.965 --> 01:13.525
that these devices can be controlled remotely,

01:14.385 --> 01:18.125
by people, whether it be for good or nefarious purposes?

01:18.465 --> 01:22.725
So we put this paper together really to, to share the,

01:22.905 --> 01:25.565
the work we've done around cybersecurity education

01:25.585 --> 01:29.205
and the pedagogy around cybersecurity education.

01:29.845 --> 01:32.765
I think what we're finding is in the, in the literature,

01:32.765 --> 01:36.605
there's not so much about people sharing

01:37.545 --> 01:40.085
how they went around educating on these topics,

01:40.095 --> 01:41.805
which I think is a really important point.

01:41.805 --> 01:43.965
There are some communities,

01:44.595 --> 01:46.565
I'll speak about sissy for an example.

01:46.935 --> 01:49.845
Colloquium information system security education.

01:50.595 --> 01:51.725
There's been a lot

01:51.725 --> 01:54.805
of work in this space in countries like the United States

01:54.905 --> 01:58.085
for a number of years in the uk not so much.

01:58.185 --> 02:00.645
And so over the last couple of years, work

02:00.645 --> 02:03.405
that I've been doing with the University of West of England

02:03.985 --> 02:07.085
has really been trying to promote not just the kind

02:07.085 --> 02:09.765
of the research around how we maintain security,

02:09.865 --> 02:13.485
but also the research around how we educate

02:13.485 --> 02:16.605
and impress upon the next generation about cybersecurity.

02:16.605 --> 02:18.805
Because I mean, these, these are students

02:18.825 --> 02:22.525
who are growing up in a world where technology is dominant,

02:22.735 --> 02:25.405
technology is what they've known straight from the off.

02:25.865 --> 02:29.525
And so being able to navigate that technology as a part

02:29.525 --> 02:32.925
of society and, you know, being able to do

02:32.925 --> 02:35.725
that in a secure manner is obviously critical.

02:35.905 --> 02:38.525
So our project, it was called Hacking an IOT Home.

02:38.825 --> 02:42.045
And as I say, this was a, this was a bit of a, a kind

02:42.045 --> 02:44.525
of detour in effect from, from some

02:44.525 --> 02:47.965
of the things we were doing, pre covid let's say.

02:48.625 --> 02:50.085
So when Covid came along

02:50.105 --> 02:52.645
and remote working, homeworking all came about,

02:54.185 --> 02:56.925
it was really looking at, well, how can we continue

02:56.925 --> 02:58.765
to do outreach with

02:58.915 --> 03:00.925
Schools, but obviously

03:01.565 --> 03:03.765
everyone working from the confines of their own homes.

03:04.875 --> 03:07.895
So what we essentially did, we rigged up my house

03:07.895 --> 03:09.095
with IOT devices.

03:09.275 --> 03:14.175
So we had light bulbs, we had smart plugs, we had, fans,

03:14.315 --> 03:18.215
we had a, a robotic vacuum cleaner and, and the like,

03:19.245 --> 03:23.065
and we linked that with a capture the flag platform.

03:23.125 --> 03:26.105
So capture the flag platforms are very popular in terms

03:26.105 --> 03:29.185
of cybersecurity education where essentially

03:30.385 --> 03:33.505
a task is set and in order to prove that

03:33.505 --> 03:36.145
that task has been completed,

03:36.285 --> 03:39.545
the student will typically find what we might call a flag.

03:39.725 --> 03:41.785
And that's really just a string of characters.

03:42.295 --> 03:45.145
They enter that into a, a dialogue prompt

03:45.525 --> 03:47.025
and it will say, congratulations.

03:47.025 --> 03:48.105
You enter the right answer.

03:48.845 --> 03:51.865
So the flag is really just something that they have to find.

03:52.085 --> 03:55.425
And that might be from doing, some sort

03:55.425 --> 03:57.945
of penetration testing exercise, some sort

03:57.945 --> 03:59.705
of digital forensics investigation.

04:00.445 --> 04:02.945
But typically these are, you know, activities

04:02.945 --> 04:04.185
that you might perform on the computer.

04:05.105 --> 04:06.445
And you see this little popup

04:06.445 --> 04:08.965
and it says, congratulations, you've, you've found a flag.

04:09.905 --> 04:11.295
We took that same concept,

04:11.635 --> 04:14.975
but we then applied that to the physical space so

04:14.975 --> 04:17.535
that instead of just being a popup on the screen,

04:18.525 --> 04:21.375
what the students would see is actually something physical

04:21.405 --> 04:23.455
occurring because of finding the flag.

04:23.875 --> 04:27.575
So essentially we had an online presentation that ran,

04:28.475 --> 04:30.255
and throughout that presentation,

04:30.865 --> 04:33.055
there were challenges dropped in.

04:33.155 --> 04:36.495
So for instance, they might have an encoded string

04:36.555 --> 04:40.215
and they have to work out that that's actually,

04:40.895 --> 04:42.015
representing ASCI values.

04:42.075 --> 04:45.815
And so they have to then decode that string, find the flag,

04:45.835 --> 04:47.535
and enter that into a prompt.

04:49.555 --> 04:52.215
The prompt essentially was a web server

04:52.245 --> 04:54.135
that was being hosted on my home network.

04:54.915 --> 04:57.055
So they would go to this website,

04:57.235 --> 05:00.295
it was a website running locally in my network

05:01.325 --> 05:03.975
when they entered the string that they had managed

05:03.995 --> 05:07.775
to decode, that would then trigger something

05:07.775 --> 05:09.055
to happen in my environment.

05:09.485 --> 05:11.615
Okay. The nice thing about this was

05:11.615 --> 05:15.415
that we had cameras rigged up around my room at home

05:16.765 --> 05:20.625
so that during this presentation I could then

05:21.465 --> 05:24.745
suddenly see, the light bulb is now flashing,

05:24.825 --> 05:26.465
a little bit distracting when I was trying

05:26.465 --> 05:28.065
to give this talk, I have to admit,

05:28.765 --> 05:32.825
but the students could see they had created some form

05:32.825 --> 05:35.065
of physical impact in my workspace.

05:36.125 --> 05:39.815
Okay. So the first challenge was finding this ask code,

05:39.815 --> 05:42.775
being able to, make this light bulb flash.

05:43.275 --> 05:44.815
And the presentation carried on

05:44.815 --> 05:46.815
and a few more challenges dropped in.

05:48.015 --> 05:50.715
And then the second one, when they entered that flag,

05:51.295 --> 05:54.035
it essentially sets a fan off in my room.

05:54.305 --> 05:57.565
Okay. So again, there's a camera pointed,

05:58.105 --> 06:02.245
rather deliberately at the shelving in the office so

06:02.245 --> 06:04.645
that they could see this fan start blowing.

06:05.025 --> 06:07.605
And it blew some confetti across my desk. Okay.

06:07.605 --> 06:10.205
So again, rather distracting for me as the presenter,

06:10.545 --> 06:13.525
rather amusing for the students that were part of this.

06:14.915 --> 06:17.535
And then the final flag was being able to trigger

06:18.135 --> 06:20.055
a robotic vacuum cleaner to come in

06:20.055 --> 06:21.335
and essentially sweep up all

06:21.335 --> 06:22.935
of this confetti that had blown everywhere.

06:23.545 --> 06:26.815
Again, you know, they had cameras they were able to see,

06:26.995 --> 06:28.655
so they had a shot of this doorway.

06:28.655 --> 06:29.895
They couldn't see what was going

06:29.915 --> 06:31.135
to happen with this doorway.

06:31.155 --> 06:35.895
So when this robot vacuum cleaner came in, again,

06:35.895 --> 06:37.695
it was quite a nice surprise for them.

06:38.195 --> 06:39.535
But the key point really,

06:40.475 --> 06:45.285
obviously this was a staged exercise for being able to,

06:45.615 --> 06:48.365
enter these flags into my environment,

06:49.265 --> 06:51.965
and then be able to trigger this, this action to occur.

06:52.945 --> 06:56.005
And obviously these students are acting

06:56.355 --> 06:58.125
with good intention, okay?

06:59.105 --> 07:01.525
But the point to impress upon them, this was a study,

07:01.705 --> 07:02.765
we ran it with students

07:02.825 --> 07:04.405
who were based in Bristol at the time.

07:04.825 --> 07:06.565
I'm 30 miles north of there,

07:07.105 --> 07:10.045
and we ran it with students from Cardiff as well.

07:10.585 --> 07:13.565
And so the key point to emphasize to them was actually,

07:13.825 --> 07:15.165
you know, this wasn't an activity

07:15.165 --> 07:16.565
taking place in a classroom.

07:16.565 --> 07:20.165
This was an activity taking place across two distinct

07:20.445 --> 07:22.005
geographical locations of the uk.

07:22.615 --> 07:24.365
Their actions in Bristol

07:24.365 --> 07:27.365
or in Cardiff were impacting me in my home.

07:28.615 --> 07:31.035
And I think that was one of the key kind of

07:31.805 --> 07:35.675
light bulb moments for, for our students in

07:35.675 --> 07:39.115
that they could see their actions were having an impact in

07:39.175 --> 07:42.475
my environment, which is very different if you run this kind

07:42.475 --> 07:43.515
of activity in a classroom.

07:43.695 --> 07:47.635
We ran this, this trial twice during the, the,

07:47.635 --> 07:48.755
the lockdown periods.

07:49.215 --> 07:51.395
So we ran it with a group of students in Bristol.

07:51.395 --> 07:53.475
We ran it with a group of students in Cardiff,

07:54.015 --> 07:55.875
and both groups are reporting,

07:55.975 --> 07:57.515
but they found the session engaging.

07:58.185 --> 08:01.555
They found the session to be very different in terms

08:01.555 --> 08:03.635
of their kind of previous education experience.

08:04.215 --> 08:07.635
And I think it's, it's really, you know, the, the purpose

08:07.695 --> 08:10.635
of the paper was really just trying to plant the seed of

08:11.415 --> 08:14.235
how do we rethink some of

08:14.235 --> 08:16.515
what we do in cybersecurity education.

08:17.415 --> 08:20.555
The typical approach is we are in a classroom together

08:20.895 --> 08:24.635
and maybe the students are logging onto a wifi access point

08:24.695 --> 08:26.995
to make something else happen in that room,

08:27.455 --> 08:29.515
but it is all in that same room.

08:30.355 --> 08:33.765
Whereas the whole, to some extent, the whole premise

08:33.865 --> 08:36.245
of cybersecurity is really to think about

08:36.395 --> 08:39.045
that remote access, that connectivity, the fact

08:39.045 --> 08:42.205
that devices, you know, I can pinging a device from, from

08:42.205 --> 08:44.485
where I am currently to the other side of the world

08:44.545 --> 08:46.365
and have a response back in seconds.

08:47.265 --> 08:51.925
So it's how do we impress upon students that connectivity

08:52.145 --> 08:53.605
beyond just a single room.

08:54.225 --> 08:57.755
So I think in terms of the kind of lessons learned,

08:57.815 --> 09:00.035
the outcomes and how we kind of take this forward,

09:00.585 --> 09:02.975
it's really how can we,

09:03.395 --> 09:05.455
how can we talk about remote teaching?

09:05.515 --> 09:08.735
How can we talk about, remote activities?

09:09.235 --> 09:11.495
And I mean, this is, this is an interesting area

09:11.555 --> 09:14.295
and we've had a lot of conversations in the university about

09:14.295 --> 09:18.095
this where we've got students all across the UK

09:18.995 --> 09:21.415
and, you know, do they always need to travel?

09:22.085 --> 09:25.335
Potentially not. There are some activities which are well

09:25.395 --> 09:26.735
suited for the lecture theater

09:26.835 --> 09:28.695
or the practical lab on the campus,

09:28.715 --> 09:31.815
and there are some activities which are better suited

09:32.115 --> 09:33.455
for remote learning.

09:33.595 --> 09:36.175
And this was one of them that we found our program

09:36.675 --> 09:38.375
is, is quite hands-on.

09:38.555 --> 09:41.535
Um, I mean there, there's a, there's a mix

09:41.535 --> 09:42.975
of different activities I guess.

09:43.095 --> 09:45.055
I mean, we, we have a number of modules we,

09:45.395 --> 09:48.095
on our master in social security at ue,

09:48.095 --> 09:52.055
we teach things from, iot system security,

09:52.095 --> 09:54.015
thinking about low power devices

09:54.235 --> 09:57.055
and the resource constraints that they have through

09:57.075 --> 09:59.255
to critical system security such

09:59.255 --> 10:02.495
as industrial control systems and cyber physical systems.

10:03.195 --> 10:05.375
And that's really where this kind of work fits in

10:05.375 --> 10:10.175
because we might be talking about how do I secure,

10:10.365 --> 10:13.575
systems that are running out on an oil rig out in the North

10:13.675 --> 10:15.615
Sea, or how do I secure systems

10:15.615 --> 10:17.535
that are running in a manufacturing plant?

10:18.235 --> 10:19.815
And again, I mean those kind of things.

10:19.875 --> 10:24.615
You've got the, you've got the hands-on aspect of,

10:25.235 --> 10:26.775
I'm, I'm mean front of a device

10:26.775 --> 10:28.855
and I need to configure this machinery

10:28.855 --> 10:30.935
to make sure it's working in the way I expect it to.

10:31.715 --> 10:35.495
But you've also got that not necessarily hand hands off

10:35.515 --> 10:39.055
as such, but how do I then observe that remotely?

10:39.555 --> 10:41.255
And it, there's always this kind of

10:41.815 --> 10:44.015
security versus convenience trade off that I talk about.

10:44.155 --> 10:47.135
You know, it's convenient for people to be able

10:47.135 --> 10:50.895
to remotely access their manufacturing plants to be able

10:50.895 --> 10:52.855
to see is it doing what it should be doing.

10:53.405 --> 10:54.575
Okay. So it's convenient,

10:54.655 --> 10:57.615
likewise for me to be able to monitor my home

10:58.135 --> 11:02.015
remotely when I'm off on my holidays, you know, like,

11:02.475 --> 11:06.215
but with that convenience also comes a security cost

11:06.215 --> 11:08.655
because if I can observe that camera feed,

11:09.085 --> 11:11.575
then there is the potential for somebody else

11:11.595 --> 11:12.815
to observe that camera feed.

11:12.855 --> 11:15.255
Likewise, if I can control devices

11:16.015 --> 11:19.295
remotely in a manufacturing plant, there is a potential

11:19.635 --> 11:20.895
for others to be able to do that.

11:21.475 --> 11:25.155
So I think it's, it's really about understanding

11:25.225 --> 11:26.955
that balance between security

11:27.015 --> 11:29.795
and convenience when we're talking about how we interact

11:29.795 --> 11:33.275
with technology and then understanding the kind

11:33.275 --> 11:36.275
of risk appetite that an in individual might have.

11:36.695 --> 11:40.765
Now, if you are, if you are prepared to take the risk

11:40.765 --> 11:45.245
because it's beneficial financially or convenience sake

11:45.345 --> 11:47.965
or whatever else it might be, that's fine.

11:48.465 --> 11:50.565
Um, other processes you say, no,

11:50.805 --> 11:52.005
actually this is how it has to be.

11:52.025 --> 11:55.085
And I guess that's where the more hands off

11:55.115 --> 11:56.285
side of it comes in.

11:56.435 --> 11:57.805
Because actually at that point,

11:57.805 --> 11:59.805
you're not just talking about the technology,

11:59.945 --> 12:02.565
but you are talking about business processes,

12:02.625 --> 12:04.045
you are talking about people

12:04.785 --> 12:09.085
and how the whole kind of business dynamic comes together

12:09.695 --> 12:12.525
where security is actually just a small components of that.

Faculti AI can make mistakes