0x010088F6312065A70A44B630A6848498EAD80093CFEAFE161DC94D83C7C5C9A5A748B8

Generally the course had too much activities and work load. So a reduction seems necessary and will be considered.

This report is based on personal observations and statistics from the course, together with information gathered from the reference group and also from the two general student surveys sent during the semester (one in the first part of the semester and the second towards the end of the second part). The final exam was well made as witnessed by the grade distribution, which has seen both some A marks as well as some E marks, thus showing that the questions were neither too difficult nor too easy. For such courses with large number of students it is the law of big numbers that governs, when the exam is done well. In pedagogy this is called alignment; one aim is to align well the learning objectives (i.e., those displayed on the webpage of the course and on the Blackboard internal landing page), with the learning activities that are meant to support the student to reach the learning objectives, and finally with the evaluation methods, in this case our final exam, which are meant to evaluate how well the student has managed to reach the learning objectives. An example of misalignment is when there are very many E marks in the final exam, meaning that the exam questions are misaligned with the learning objectives, or in other words, when the teacher expectations of the learning of the students is misaligned with the expectations of the students. A similarly extreme example of misalignment is when there are very many A marks in the exam, show again, this time from a different angle, an error in learning expectations and achievements and their measuring. The course had multiple activities, all listed in the Blackboard pages describing the plans and content of the course. The include the standard lectures, online with shorter time frame to match the shorter attention span known by psychologists and pedagogues for such new forms of teaching; i.e. 20min + 5min break +20min lecture +15min big break. We also had the standard lab sessions where students work with the content of the course on specifically defined larger project tasks. These are meant to train the student in cognitive tasks that are not easy to evaluate, but very important to gain, namely, to train their problem-solving and creativity capacities. Of course, these are specifically thought for the content taught in the course, so creativity in using the new security concepts and methods taught, and problem-solving of a quite standard problem setting for our course, one that often is encountered in reality, in the programming team context. Some of the labs were organized on campus, though with little attendance, unfortunately, and yet inexplicably. Other activities, mostly extracurricular, included:- The S2G Playground where every 2 weeks are organized CTF and Hackaton kind of events for NTNU student. Here the student of the course could have exercised security skills, some relevant for the course.- The NCR for students to participate in actual security training events.- Research based lecture/lab where a topic outside the syllabus book was brought to the student's attention.- Guest lecturer from industry.- Sustainability lab, where the students have been exposed to issues related to sustainability and cyber security, guided by an exert in digital sustainability brought in from outside the course. Unfortunately, not much feedback has been received about these activities, neither from the students nor from the leadership. This tells that such activities had no interest among the students. In fact there have been a few negative feedback. As a consequence, we will remove these activities in the future courses. So, the S2G Playground and NCR will no longer be advertised to the students (note that these were not imposed, but only presented as opportunities). Guests from outside the course will be avoided.

We will generally keep to the standard format of lectures and lab sessions. Here too we will consider adjustments based on the feedback. One adjustment is to work on making the lectures more entertaining and captivating. Also the lab sessions can be thought more practical, if there will be enough resources provided by the leadership, as until now this course has had too little teaching/lab personnel. We are also considering reducing the syllabus as complains about the thickness of the book of the course have been raised. Recall that this book is the official book guide to the internationally well sought for security certifications in the field of software development provided by the ISC2 organization. Thus, one goal of the course was to prepare the students for such certifications with many of the companies require of their employees nowadays. Now we will consider trimming down the content and concepts, and only cherry-picking from this book still, leaving the rest to the students private interests. Generally we are considering the in the future changes that might give the students more guidance and coordination with less material as well as more time for other activities, thus more independence in the learning process while still offering the expert teaching resource that the university is supposed to.

NTNU:TIA:REST

Institutt for informasjonssikkerhet og kommunikasjonsteknologi

Department of Information Security and Communication Technology

Ingen hjelpemidler tillatt.

Engelsk

Mer om vurdering

Utsatt eksamen i august gjelder skriftlig eksamen.Obligatoriske oppgaver må være godkjent for å kunne delta i avsluttende skriftlig eksamen.

Anbefalte forkunnskaper

<ul><li>PROG1003 Objekt-orientert programmering</li><li>IDATG2102 Algoritmiske metoder</li><li>IDATG2202 Operativsystemer</li></ul>

Faglig innhold

Kursmateriell

Paul, M. (2013). Official (ISC) 2 Guide to the CSSLP. CRC Press.

Læringsutbytte

Kunnskaper<ul><li>Etter endt emne har studentene grunnleggende kunnskap om hvordan programvarer kan både skapes og vedlikeholdes med tanke på sikkerhet, dvs. avvik fra forventet funksjonalitet grunnet interaksjon med en fiende. </li><li>De forstår typiske angrepsmønstre, bla. format string problemer, command injection.</li><li>Studentene har oversikt over eksisterende teknologier, typer av verktøy, og metodene som brukes i programvareutvikling i dag.</li></ul>Ferdigheter<ul><li>Studentene kan anvende kunnskapen på problemstillinger i næringsliv og forskningssammenheng. </li><li>De er i stand til å identifisere potensielle trusler og sårbarheter tidlig i et programs livsløp og anvender tiltak som forhindrer eller reduserer sårbarheter i programvarer.</li></ul>Generell kompetanse<ul><li>Studentene klarer å formidle sine analyser og forslag til andre utviklere, foresatte og kunder.</li></ul>

Læringsformer og aktiviteter

<ul><li>Forelesninger</li><li>Lab.øvelser</li><li>Obligatoriske oppgaver </li><li>Hjemmelesing</li><li>Gruppearbeid (oppmuntret, ikke obligatorisk)</li><li>Lab om Bærekraft</li><li>Quiz</li></ul>Obligatoriske arbeidskrav: Alle obligatoriske øvelser må være godkjent.

Obligatoriske oppgaver

Software Security

Informatikk

Bachelor i programmering

Bachelor i digital infrastruktur og cybersikkerhet

Bachelor i ingeniørfag - data

Web/Lists(guid'8b698a2d-6ad0-4f7d-b3be-219cc1979f02')/Items(25018)/FieldValuesAsText

The most useful observations made by the students during the semester are related to the obligs, i.e., criticising the group work and the vagueness/specificity of the oblig tasks descriptions. In response to these I will work to make in the future the obligs more descriptive, maybe with slides or short presentation videos that are more entertaining. Also I will allow a more flexible group work and delivery. The labs where students are supposed to work on the obligs in groups will include more interactive activities regarding intermediary milestones for one oblig. Maybe also useful in this respect can be to take in use some more modern student interaction and engaging tools such as Kahoot or Menti. One particular aspect that students reported that they enjoyed was to tell them (and connect them) with the S2G Playground whether they could participate in practical CTF events. I will continue to make these connections in the next years.

A large majority of registered students handed in successfully the two obligatory assignments for this course. One observation from the assignments is that I could see an increase in quality, with the later assignments showing more control of specific security terminology and better use of more complex concepts and methods. The most successful students, judging from the quality of their assignments, were given at the end of the semester, before the final exams, a “Outstanding Student Award” (3 in total). Generally the course covered the planned content with some exceptions, i.e., some content was removed from the final lecture for which we no longer had time due to various delays that have accumulated during the semester. But overall, I could also say that the content could be increased by adding in one more topic. This I will consider for the future edition of the course. From the final exam one can see a good coverage of the grading spectrum, having also quite a few students that have achieved grade A. This shows that this year we had quite good students, some of which managed to follow even the most difficult parts of the course. These students need to be encouraged through some forms of incentives to continue their good learning actions, for example by working within a research group as TAs or summer interns or even apply for PhD positions.

We have used one single book as the main course material. This has been well received by the students, not only because the book was good but also because it reduced stress with navigating through many material sources. Still, the course web pages have been listing more resources, besides the lecture slides and recordings. Some students found this extra material beneficial, especially the suggestions that I gave for alternative books for reading and other good links to online resources and documents. Not all students use these; in fact some students have difficulty even following the book because we do not cover all the book, and one needs to read the course web pages or the slides in order to be able to identify the exact book chapters that one needs to focus on. But this is not so much of a problem since reading more from the book can only be beneficial.

<ul><li>Forelesninger</li><li>Lab.øvelser</li><li>Obligatoriske oppgaver </li><li>Hjemmelesing</li><li>Gruppearbeid (oppmuntret, ikke obligatorisk)</li><li>Quiz</li></ul>Obligatoriske arbeidskrav: Alle obligatoriske øvelser må være godkjent.

Bachelor i ingeniørfag, data

Web/Lists(guid'8b698a2d-6ad0-4f7d-b3be-219cc1979f02')/Items(19533)/FieldValuesAsText

Some of the points made by the students during the semester are rather useful, especially the ones related to the lectures.In response to these I will work to make in the future the lectures more engaging, maybe with slides that are more entertaining, and also to include more intermediary activities. Maybe also useful in this respect can be to take in use more some modern lecturing tools such as Kahoot or Menti. One particular novel aspect that students reported that they enjoyed was to tell them (and connect them) with the S2G Playground whether they could participate in practical CTF events. I will continue to make these connections in the next years.

A large majority of registered students handed in successfully the three obligatory assignments for this course. One observation from the assignments is that I could see an increase in quality, with the later assignments showing more control of specific security terminology and better use of more complex concepts and methods. Generally the course covered the planned content with one exception being part of the final lecture for which we no longer had time to teach due to various delays that have accumulated during the semester. But overall, I could also say that the content could be increased by adding in one more topic. This I will consider for the future edition of the course. From the final exam one can see a good coverage of the grading spectrum, having also quite a few students that have achieved grade A. This shows that this year we had quite good students, some of which managed to follow even the most difficult parts of the course. These students need to be enouraged through some forms of incentives to continue their good learning actions, for example by working within a research group as TAs or summer interns or why not even apply for PhD positions.

IMT1082 - Objekt-orientert programmering IMT2021 - Algoritmiske metoder IMT2282 - Operativsystemer

Utsatt eksamen i august gjelder skriftlig eksamen.En avsluttende skriftlig eksamen vil telle 40% av sluttkarakteren.En portefølje mappe av mindre merkede oppgaver vil telle 60% av sluttkarakteren. De presise oppgavene defineres i løpet av kurset. Disse vil være relatert til laboratoriearbeidet.Obligatoriske oppgaver må bestås for å kunne delta i avsluttende skriftlig eksamen.

<ul><li>Forelesninger</li><li>Lab.øvelser</li><li>Obligatoriske oppgaver </li><li>Hjemmelesing</li><li>Gruppearbeid (oppmuntret, ikke obligatorisk)</li><li>Quiz</li></ul>Obligatoriske arbeidskrav: Alle obligatoriske øvelser må være godkjent.

Kunnskaper<ul><li>Etter endt emne har studentene grunnleggende kunnskap om hvordan programvarer kan både skapes og vedlikeholdes med tanke på sikkerhet, dvs. avvik fra forventet funksjonalitet grunnet interaksjon med en fiende. </li><li>De forstår typiske angrepsmønstre, bla. format string  problemer, command injection.</li><li>Studentene har oversikt over eksisterende teknologier, typer av verktøy, og metodene som brukes i programvareutvikling i dag.</li></ul>Ferdigheter<ul><li>Studentene kan anvende kunnskapen på problemstillinger i næringsliv og forskningssammenheng. </li><li>De er i stand til å identifisere potensielle trusler og sårbarheter tidlig i et programs livsløp og anvender tiltak som forhindrer eller reduserer sårbarheter i programvarer.</li></ul>Generell kompetanse<ul><li>Studentene klarer å formidle sine analyser og forslag til andre utviklere, foresatte og kunder.</li></ul>

Obligatorisk arbeidskrav

Web/Lists(guid'8b698a2d-6ad0-4f7d-b3be-219cc1979f02')/Items(13995)/FieldValuesAsText

Software Security - IIKG2001