1. New Forms of Experiential Education on Cyber-Physical Security
Yunsi Fei
Keywords
Competition
Attack and defense
Team work
New Forms of Experiential Education on Cyber-Physical Security

2. Why?
NU’s unique brand of experiential learning and co-op program have been well recognized
Cyber and physical security is a requirement of many real-world systems and infrastructures
Secure design and implementation (defense) require deep understanding of vulnerabilities – attacks
Competition-based lab course will be an effective and innovative form of experiential education on practical security

3. What? Embedded Catch-the-Flag Competition Two phases
Six weeks of secure design and implementation of a digital lock/PIN system
Six weeks of hacking on other teams’ implementations, catch the flags
Final project presentation

4. How? Learning objectives Advisor-student interaction
Learn the basic design principles for secure embedded systems
Apply these principles into the real design and implementation
Identify vulnerabilities of an embedded device and launch real attacks
Understand the hacking process and perform ethic hacking.
Advisor-student interaction
More hands-off advising – similar to research
Open-ended design and flexibility
Advisor suggests reading materials, helps the design process, introduces possible attacks, sets up timeline and checkpoints, and monitors progress
Encourage team work

5. Where?
Northeastern University, and/or other universities in the New England area
Pilot course in Spring 2016: 4 credit Independent Study
Two NU teams participated in a competition among four universities
Each team 8 students (mostly senior ECE students)
Collaborative team work
Vigorous testing, debugging, and reprogramming
Report and presentation

6. Prognosis Competition
Effective and engaging competition design
Allocation of time between the two phases
More post-competition feedback on the design, implementation, and attacks
Appropriate team size
How to make the competition multi-disciplinary – cyber, physical, infrastructure, and social engineering?
How to involve more advisors/faculty members?
How to evaluate the class?