Realism in Teaching Cybersecurity Research: The Agile Research Process - eScholarship

Realism in Teaching Cybersecurity Research: The Agile Research Process Melissa Dark 1 , Matt Bishop 2 , Richard Linger 3 , and Luanne Goldrich 4 Computer and Information Technology Department, Purdue University, West Lafayette, IN 47907 USA dark@purdue.edu Dept. of Computer Science, University of California, Davis Davis, CA 95616-8562 USA mabishop@ucdavis.edu Cyber and Information Security Research Group, Oak Ridge National Laboratory, Oak Ridge, TN 37831 USA lingerr@ornl.gov Johns Hopkins University Applied Physics Laboratory Laurel, MD 20723 USA Luanne.Goldrich@jhuapl.edu Abstract. As global threats to information systems continue to in- crease, the value of effective cybersecurity research has never been greater. There is a pressing need to educate future researchers about the research process itself, which is increasingly unpredictable, multi-disciplinary, multi- organizational, and team-oriented. In addition, there is a growing de- mand for cybersecurity research that can produce fast, authoritative, and actionable results. In short, speed matters. Organizations conduct- ing cyber defense can benefit from the knowledge and experience of the best minds in order to make effective decisions in difficult and fast mov- ing situations. The Agile Research process is a new approach to pro- vide such rapid, authoritative, applied research. It is designed to be fast, transparent, and iterative, with each iteration producing results that can be applied quickly. Purdue University is employing Agile Research as a teaching vehicle in an innovative, multi-university graduate program with government sponsor participation, as described in this paper. Because it simulates real-world operations and processes, this program is equipping students to become effective contributors to cybersecurity research. A New Approach to Teaching Cybersecurity Research Graduate programs in computer security emphasize research. Students who pur- sue a masters degree by writing a thesis or a doctoral degree by writing a dis- sertation are expected to do research that contributes to the body of knowledge. This dedicated study of a research problem requires students to be motivated and interested in the problem, and to understand the context in which the problem arises. The obvious way to do this is to study a particular facet of the problem in an applied circumstance. The student can then understand the constraints and available mechanisms, and attempt to develop a methodology or theory that will solve the problem in this specific instance. This leads to a good masters thesis. Doctoral students can then generalize the problem by relaxing the constraints