Large scale, real-time systems security analysis in higher education

Abstract

This paper discusses the positive and negative aspects of large scale, real time systems' security (e.g, SCADA and industrial control) as currently taught in higher education. Until recently SCADA and industrial control systems security (ICS) has not been a strong focus in university curricula. As a result of new cyber security education initiatives and wide spread attacks like Stuxnet and DUQU, it has become necessary to instruct students from information technology (IT) and engineering disciplines how to secure environments with thousands of real-time nodes, such as those in SCADA and ICS. Computing disciplines address cyber security to varying degrees. However, the extent to which SCADA/ICS system security is currently incorporated varies from little to none. To help address this problem, this paper proposes an educational model where computing disciplines can focus on the cyber security aspects of SCADA/ICS that are more closely related to their core objectives. We propose an educational model in which all computing disciplines follow a more structured awareness of SCADA/ICS security issues. Electrical and Computer Engineering (ECE) students should use best design practices to securely develop embedded hardware. ISYS students should be aware of the business impacts involved in security failures of SCADA/ICS environments and policies. Computer Science will be responsible for developing secure software. IT should be responsible for developing secure systems, and using theoretical and experiential training in developing a secure system from end to end. There are a number of tools to assist in this development. Some of the tools available include: standards and guidelines for security analysis and development, and simulation environments for experiential training. We recommend a framework be developed to further incorporate this model. © 2012 American Society for Engineering Education.