Teaching a web security course to practice information assurance

ABSTRACT

This paper presents a hybrid teaching approach, a new Web Security course as well as how to use the hybrid approach to teach the Web Security course to practice information assurance. The hybrid teaching approach contains three key issues that are keeping the lecture materials up-to-date, assigning former research projects as comprehensive team projects, and connecting classroom knowledge with real world web applications. We have applied this approach to the teaching a Web Security course and achieved excellent results. Our experience exhibits that integrating education, research and web applications into the Web Security course to practice information assurance are essential for a sound security education. Using this approach instructors connect knowledge in the classroom to real world applications, attract students to the security area, and train students to become information assurance professionals.

REFERENCES

• 1: Matt Bishop, Introduction to Computer Security, Addison-Wesley Professional, 2004
• 2: Rao, G.S.V.R.K. Threats and security of Web services - a theoretical short study. In Proceedings of IEEE International Symposium Communications and Information Technology, 2004, 783--786.
• 3: Rolf Oppliger, Security Technologies for the World Wide Web, Artech House, Inc., Norwood, MA, 2002
• 4: Aviel D. Rubin , Daniel E. Geer Jr., A Survey of Web Security, Computer, v.31 n.9, p.34-41, September 1998 [doi>10.1109/2.708448 ]
• 5: Rutschman, D., Yu, H., Emmanuel, N. and Wang, L. WebGISRCI: A Web-based GIS Road Closure Information System. In Proceedings of the Int. Conf. on Information and Knowledge Sharing, November 2002, 167--172.
• 6: David Scott , Richard Sharp, Developing Secure Web Applications, IEEE Internet Computing, v.6 n.6, p.38-45, November 2002 [doi>10.1109/MIC.2002.1067735 ]
• 7: Scott, D. and Sharp, R. Specifying and Enforcing Application-Level Web Security Policies. IEEE Transactions on Knowledge and Data Engineering, Vol. 15, No. 4, July 2003, 771--783.
• 8: William Stallings, Cryptography and network security (2nd ed.): principles and practice, Prentice-Hall, Inc., Upper Saddle River, NJ, 1998
• 9: Steele, G. and Stojkovic, V. An Information System Security Course for the Undergraduate Information Systems Curriculum. Information Systems Education Journal, Vol. 2, No. 3, 2004, 3--14.
• 10: Striletchi, C. and Vaida, M. F. Enhancing the Security of Web Applications. In Proceedings of the 25th International Conference on Information Technology Interfaces, June 2003, 463--468.
• 11: Yu, H., Zhang, J., Wang, L. and Barksdale, J. A Secure Web Application: 3D Visualization and Collaboration. In Proceedings of The 2nd IASTED International Conference on Communication, Internet, and Information Technology, November 2003, 13--18.
• 12: Bingyang Zhou, An Integrated Web Security System, Proceedings of the 14th International Workshop on Database and Expert Systems Applications, p.204, September 01-05, 2003

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.0 General

General Terms:
Security

Keywords:
hybrid teaching approach, information assurance education, web security