Portland State cybersecurity students hunt malicious code in the cloud

Dr. Wu-chang Feng is Associate Professor of Computer Science at the Maseeh College of Engineering and Computer Science at Portland State University in Portland, Oregon. With support from the National Science Foundation (NSF), Dr. Feng is developing an innovative open-source curriculum to share with computer security instructors across the country. His program features a Capture the Flag (CTF) challenge for students, a "fun introduction to computer security" deployed inside the Google Cloud Platform (GCP).

The U.S. Department of Commerce reports the demand for cybersecurity professionals is accelerating, with more jobs open than skilled workers trained to fill them. The need is urgent: Research projects cybercrime will cost businesses more than $2 trillion globally by 2019.

"It is estimated that a security flaw occurs in every 100 lines of code written," says Dr. Wu-chang Feng, Associate Professor of Computer Science at the Maseeh College of Engineering and Computer Science at Portland State University in Portland, Oregon. Dr. Fengs students are training inside the Google Cloud Platform (GCP) to prepare for careers in cybersecurity. He introduced GCP into his courses in 2015 after attending a Google Faculty Institute.

With support from the National Science Foundation (NSF), Dr. Feng is designing an innovative, open-source curriculum, using GCP tools to teach students emerging techniques "that will revolutionize how software is being tested and validated." He also uses GCP tools in his web development and cloud systems courses, challenging students to grapple with real-world computer security issues by developing their problem-solving skills inside the cloud.

"It is estimated that a security flaw occurs in every 100 lines of code written."

Dr. Wu-chang Feng, Associate Professor of Computer Science, Portland State University

The Hunt for Malware

Dr. Feng's NSF-funded pilot program teaches graduate students how to use smart fuzzing and symbolic execution tools that automatically discover and patch vulnerabilities in computing systems. "While these techniques are widely used in industry, few academic programs include these concepts in their educational programs," he says. At the program's core are hands-on, Capture the Flag (CTF) cybersecurity challenges—what Dr. Feng calls "a treasure hunt for evidence or fake private information, leveraging students' ability to find things in the cloud."

Each student receives a unique set of challenges to test their cybersecurity skills as they search for software vulnerabilities and malicious code deployed inside the Google Cloud. "It's a fun introduction to computer security," he says. The security challenges are scaffolded and customized to each student's abilities, allowing them to build confidence as well as competence.

Google Cloud Platform provides the ideal controlled environment for these malware hunting exercises, protecting university computers and systems on-premises. "Our IT staff has enough to worry about without dealing with the security of our infrastructure," Dr. Feng says. "These are brute force methods for finding vulnerabilities, and it makes sense to have students run those in the cloud rather than on the local workstation."

Dr. Feng has students work on Google Compute Engine Virtual Machines (VMs) for their ease of use, fast booting, and consistently high performance. "Google VMs let me control repeatable lab exercises, giving students the exact experience they would get in the real world if they were asked to secure a machine," Dr. Feng says. "With Google, everybody starts with the same baseline." He plans to share his final curriculum with computer science instructors across the country, so they too may teach these new cybersecurity techniques to their students.

Next-Generation Cybersecurity Engineers

Dr. Feng uses Google Cloud Platform tools in several other courses, including his Internet, Web, and Cloud Systems course. "This is the course I want all students to have in order to be functional in the workplace after graduation," Dr. Feng says. Students who don't have a GCP account may create one with $300 in credits as part of GCP’s trial offer. Students learn how to set up their own Google Compute Engine VMs, where they get hands-on practice in constructing web applications backed by databases and building networking applications. Students also learn to use cloud tools for data analysis and machine learning applications.

"It's a 10-week sprint through the essentials of modern systems with hands-on labs that draw heavily from GCP Codelabs," Dr. Feng says. Google Developers Codelabs provides a guided, tutorial and hands-on coding experience, walking students through the process of building a small application or adding a new feature to an existing application.

Dr. Feng plans to introduce a new course in Blockchain Development and Security. "Because blockchains used in enterprises will likely be hosted in cloud environments, we have developed scaffolded Codelab sequences using GCP that walk students through a 'full-stack' blockchain deployment," he says. If blockchains, or distributed ledgers, are the future of cybersecurity, then Dr. Feng will be training the next generation of cybersecurity engineers. "Students tell me their experience working with Google Cloud is enabling them to get jobs."

One of his students noted his classroom experience with GCP Codelabs and VMs led to his being hired as an entry-level cloud ops engineer. The student said his employers "were very impressed that I knew about dockers, containers, and Google Kubernetes Engine, let alone had experience with them."

Sources:

Thanks for signing up!

Let us know more about your interests.