Second Annual Report The following is to be appended to the NSF Report of 2003-2004. Research and Education Activities: C. Major achievements and activities, not including staff development or training, for second year to date are listed in log format for period ending May 30, 2005. 18 Jun 04 National Visiting Committee met to review 1st year project progress. 14 Aug 04 Presentation to Austin Community College on Computer Security curriculum integration Aug 04 Three faculty/staff members passed the CompTia Security + certification 1 Sept 04 Fall Semester the department offered the following prototype ITSY courses: ITSY 2400 Operating Systems Security ITSY 2401 Firewalls and Network Security ITSY 2441 Security Management Practices Oct 04 Associate of Applied Science in Computer Information Systems Information Systems Security Emphasis and Associate of Applied Science in Information Computer Forensics Emphasis approved by Texas Higher Education Coordinating Board 7 Oct 04 Texas Association of College Technical Educators Conference presentation “Cyber Security Training . . . It's In Our Court .. . . Now What Do We Do With It?" to community college administrators and educators. 13-15 Oct 04 NSF ATE Annual PI Conference, made presentation “Using Cyber Security Command Post Exercises To Identify Workforce Needs” 27 Oct 04 Del Mar College Computer Science & Information Technology Networking Advisory Committee met to review program’s curricula and proposed advanced certificates. The addition of an Advanced Technical Certificate in Computer Forensics and Information Systems Security were approved and recommended for inclusion in department’s program. 1 Nov 04 Completed the HR selection process and hired the project’s full-time media developer. 12 Nov 04 Submitted Advance Technical Certificates for Information Security and Computer Forensics to Del Mar College Curriculum Committee for approval for inclusion in school inventory for school year Fall 2006. 15 Dec 04 Received completed signed articulation agreement between Texas&M University-Kingsville, Kingsville Texas and Del Mar College Computer Science and Information Technology Department for the Bachelors of Arts in Applied Science degree. 2 Jan 05 Completed the HR selection/hiring process and brought onboard the second full-time media developer for the project. Jan 04 Spring 2005 semester offered prototype ITSY or related security course as follows: ITSY 2443 Computer Systems Forensics ITSE 2470 Advance Programming, Cryptography, Encryption Technologies ITSC 1347 Unix Administration II 1 Feb 05 Received completed signed articulation agreement between the University of the Incarnate Word, San Antonio, Texas and Del Mar College Computer Science and Information Technology Department for the Bachelors of Arts in Applied Science degree. 15 Feb 05 Partnered with Texas A&M College Station in development and submission of NSF Grant proposal “The Cybersecurity Remote Education Access Toolkits (CREAT) submitted Feb 15, 2005 16 Feb 05 Texas Higher Education Coordinating Board makes site visit to Del Mar College Campus. DMC Computer Science and Information Technology Department receives its second consecutive Exemplary Rating for all curriculum areas including Information Systems Security and Computer Forensics 18 Feb 05 Texas Community College Teacher’s Association presentation “Computer Security and Computer Forensics Education” 22 Feb 05 Project course developers (Morgan & Pallemoni) undergo Cisco Learning Institutes’s Virtuoso authoring training which is one of two course delivery platform that project PIs are reviewing. Discussions were initiated to develop a MOA to include the projects course deliverable as content material as the institution has been invited as a partner. 23 Feb 05 Final meeting with WKMC architects on computer forensics lab to review specifications. 1 Mar 05 Submitted initial request to the Texas Higher Education Coordinating Board for Advanced Technical Certificate in Information Systems Security and Advanced Technical Certificate in Computer Forensics 29 Mar 05 Continued articulation agreement discussion between the University of Texas-San Antonio, San Antonio, TX Business Department and Del Mar College Computer Science and Information Technology Department in San Antonio Texas for a 2+2 degree and the inverted Bachelor degree. Tour UTSA campus with potential UTSA students from Del Mar College security program. 22 Mar 05 Ground breaking for the Health Sciences and Emerging Technology Complex at the Del Mar College West Campus which will include a dedicated 1,100 sq. ft. computer forensics laboratory. 23 Mar 05 Collaborated with Collin County Community College, Southwest Texas Junior College, North Harris Community College and Texas State Technical College-Waco in soliciting a Texas Higher Education Coordinating Board Curriculum Leadership Grant in the area of Digital Computer Forensics State wide curriculum development initiative 15-17 Apr 05 Del Mar College students will participate in the 1st Southwest Collegiate Cyber Defense Competition with Texas A&M College Station, University of TexasAustin, University of Texas-San Antonio, and University of North Texas students . 25 Apr 05 Visit with North Harris Community College District to discuss integration of Computer Security programs/courses with their Homeland Security Initiative 29 April 05 Conduct 1st Annual Del Mar College Cyber Security Conference “Lock It Down” in conjunction with Corpus Christi Chamber of Commerce and Education Service Center Region 2. II. Project Findings Year Two project findings relative to second year objectives are as follows: Objective 2-1. Recruit cyber-security teachers from ISD and college partners. The department is scheduled to present a 5-day “Fundamentals of Security” course in July 2005 as a preparatory instructor’s course for its regional members. Teachers from the following Independent School Districts have indicated participation: Corpus Christi Independent (5 schools), Flour Bluff, Rockport-Fulton, Gregory Portland, Tuloso Midway, and West Oso. College partners indicating participation include: Coastal Bend (2 campuses), Southwest Texas Junior College (3 campuses), and Frank Phillips College. The purpose of the course is to provide a basic security foundation to instructors as well as methodologies and suggested equipment to implement a curriculum at their institution. Members of this NSF project have also worked closely with the faculty at Austin Community College, Austin, TX, by providing them assistance and information to establish a security program. A presentation was made at a divisional faculty meeting in Austin, TX in August 2004 followed by visit by their faculty in February 2005 to Del Mar’s campus. Project members shared perspectives on curriculum issues, equipment lists, laboratory configuration, and book lists. The project will be sharing developed materials with their faculty and an Austin instructor has agreed to validate a ethics learning module currently being developed. In February 2004, UTSA Center for Information and Assurance’s (CIAS) Director proposed that DMC become a partner in its “Dark Screen” cyber command post exercise for municipalities. The project PI has solicited the MIS Department of the City of Corpus Christi and the Computer Science Department of Texas A&M-Corpus Christi to join in a Memorandum of Understanding as a partner to conduct phase II and III of this exercise. Both of these institutions have agreed to become partners and discussions as how to facilitate this agreement are ongoing at the time of this report. Del Mar became a member of a Texas College Perkins Leadership Consortium that will be developing curriculum and modules focusing on digital computer forensics and evidence handling for statewide dissemination. This group will leverage off the material developed by DMC’s current NSF project to focus on the criminal justice and legal aspects of digital forensics. Colleges partners participating in this program are Collin County, North Harris Montgomery, Lamar Institute of Technology, Tomball, Southwest Texas Junior College. On April 25, 2005, the project PI (Lee) and Co-PI (Wilsker) will present to North Harris Community College District a presentation on courses which might be integrated into their Homeland Security curriculum project. Objective 2-2. Provide training to partnered ISD teachers and colleges In this project year, the project PIs have made several presentation to promote the program and general security awareness. In October 2005 at the Fall Texas Association of College Technical Educators Conference (TACTE) the topic “Cyber Security Training . . . It's In Our Court .. . . Now What Do We Do With It?" was presented to community college administrators and educators. In February 2005 the PIs at the annual Texas Community College Teacher’s Association meeting made the presentation “Computer Security and Computer Forensics Education” On April 29th, Del Mar will be sponsoring its 1st CyberSecurity and Computer Forensics Symposium “Lock It Down!” in conjunction with the Corpus Christi Chamber of Commerce and the Education Service Center Region 2. The focus of the one day event will be general security awareness and the evolving threat landscape for small businesses and educators. General breakout session topics include identity theft, phishing, wireless security, and Unix security. The symposium is also part of this year’s department’s recruiting program as all of the students of the department’s Cisco Local Academies and its partnered colleges are invited. An Introduction to Computer Security Fundamentals training is scheduled for July 1822, 2005 as another facet of the project’s dissemination and training for partnered colleges and public school teachers. The following entities will be sending teachers to participate: Corpus Christi Independent School District, Coastal Bend College, Southwest Junior College, Frank Phillips College, Flour Bluff Independent School District and West Oso Independent School District. A presentation proposal has been submitted to the Association of Computer Educators of Texas (ACET) for its fall conference entitled “Using the Collegiate Cyber Defense Competition (CCDC) As A Summative Tool For Security Curriculum Evaluation” Objective 2-3. Develop technician training curriculum model for 2 year college The project has developed a degree plan approved by the Texas Higher Education Coordinating Board which has been shared with partnered institutions. Each course has recommended syllabus description with detailed learning objectives. A Learning Activities Plan and Learning Assessment Plan exists for each course (these are currently being revised and expanded). These materials have been shared with the following colleges: Austin Community College, Frank Phillips College and St. Phillips College. Objective 2-4. Develop model articulation agreements The project has successfully negotiated signed articulation agreements with Texas A&M-Kingsville, Kingsville, TX (December 15, 2005) and the University of the Incarnate Word, San Antonio TX (February 1, 2005) with the inverted Bachelor degree more commonly referred to as the Bachelor of Arts in Applied Science (BAAS). Initial negotiations with the University of Texas-San Antonio (UTSA) has also been initiated for the BAAS degree. Graduates from the project’s security program can articulate to UTSA’s BAAS Information Assurance program. Discussions with the UTSA’s Information Chair, Dr. Glenn Dietrich, to develop a 2+2 program has been initiated with a program articulating into its BBA Information Assurance track. The articulation specifics will be presented at the July training of objective 1 above. Objective 2-5. Develop learning modules The following courses have been taught at least 1 time as a prototype using the traditional instructor lead delivery mode with formative evaluation on “what works” collected: ITSY 1300 Fundamentals of Computer Security ITSY 2400 Operating System Security ITSY 2401 Firewalls and Network Security ITSY 2441 Security Management Practices ITSY 2443 Computer System Forensics ITSE 2470 Advance Programming Cryptography and Encryption Technologies Formative evaluation is being conducted with evaluation methodologies such instructor observations, analysis of student performance, and instructional peer review/discussion to determine if instructional strategies, materials learning activities, or assessment vehicles should be altered. Data gathered from this analysis will be used in material included in modules for web/CBT delivery. Since DMC is a member of the Cisco Academy Program the project has been invited to participate in Cisco’s Learning Institute’s Virtuoso authoring project as a charitable partner. Although the project has a existing project development for a proprietary delivery engine, this agreement will provide an additional avenue for delivery for content access, availability and affordability. Objective 2-6. Prototype formative evaluations on class modules A unique quasi meta-analysis methodology will be used by this project as one form of summative evaluation on instruction strategies, assessment and materials developed thus far for the prototype instructional modules. Eight students who have been enrolled in the project’s security courses will be participating in a UTSA sponsored “Collegiate Cyber Defense Competition” three day event.. Student teams will be placed into a simulated business environment with a predefined, preconfigured, operational network with identical hardware and software. Teams will be evaluated based on their ability to detect and respond to outside threats, maintain availability of existing services such as mail servers and web servers, respond to business requests such as the addition or removal of additional services, while balancing security needs against business needs A commercially experienced red team will attempt to infiltrate or disrupt each team’s daily operations throughout the three day competition. Teams will be scored on its ability to limit disruptions and maintain services and will be provided a log of points earned or lost on a list of metrics. This exercise will provide a near real-world experience for these students and a unique data gathering model for the project PIs. The project’s PIs and the department’s security instructors will use the aggregate of data from the exercise metrics as a form of “analysis of analyses” to validate whether the project has met the project’s educational and training objectives and provide a “gap analysis” of the curriculum. From this evaluation a decision will be made if additional modification to the curriculum, course and materials would be required which in turn will affect the development of the CBT modules. Objective 2-7. Publish and disseminate degree plans The project’s two associate degrees were approved by the THECB in Fall 2004. These degree plans are currently included in the institution’s 2004-2005 Catalog and Student Handbook as well as in the Del Mar College website. Departmental fact sheets with the degree plans are also published and been made available to DMC counselors and to area high school counselors. These catalogs and fact sheets are routinely distributed at the various area high school career day events, Tech-prep consortium meetings and all recruiting outreach programs. Objective 2-8. Enroll-non degree participation in certification courses The two Advanced Technical Certificates (ATC) developed by this project have not been approved by the state coordinating board at the time of this report as the development of these certificates were delayed one year. Supporting documents for the establishment of these certificate are required to be submitted to the THECB by May 2005 as part of the approval process for inclusion for Fall 2005. The ATCs have been submitted and approved by relevant institutional entities. Potential ATC students are required to meet one of the following criteria to earn an ATC: 1) completed a related associate degree 2) posses a bachelor degree 3) or have junior standing. Currently two enrolled students meeting that requirement are currently enroll to earn an ATC once they are approved. Objective 2-9. Submit summation of cyber security/computer forensics pilot project at League of Innovation conferences The last objective for year two was to present a summation of the formative aspects of implementing the curriculum at a League of Innovation Conference. However; the Call for Proposals for the regional League of Innovation 2005 Conferences did not include a security topic in which to submit such a proposal. Instead, the PI has submitted a proposal to Association for Computer Educators of Texas (ACET) for its 2005 Fall conference in Dallas, TX.. The title of the proposal is “Using the Collegiate Cyber Defense Competition (CCDC) As A Summative Tool For Security Curriculum Evaluation”. The proposal will outline how the project’s security instructors used the CCDC (see objective 6), an exercise based on the U.S. Military’s Academy’s Cyber Defense Exercise, to validate student learning as well as to identify additional learning objectives for inclusion into the security curriculum. Eight project students will be participating as a team in the region’s first CCDC hosted by the University of Texas-San Antonio. Teams from the University of Texas-San Antonio, The University of Texas at Austin, Texas A&M University-College Station, and the University of North Texas will also participate in a three day event on April 15-17, 2005. III. Existing Program Impact Year Two: The project in its second calendar year has identified several pertinent items that have program wide impact for the CSIT department’s computer science and information technology curriculum. These include: 1) the need to place a greater emphasis on computer ethics and social implications 2) to promote a better understanding of the broader “business process” perspective versus the “technical” aspects within information technology education 3) greater recruiting efforts for women and 4) achieve institutionalization of the project results. Rather than create a separate course for “ethics”, the department will develop a module that would include various ethical decision making theories, e.g. social contract theory, Kantianism, utilitarianism, etc.; case histories; and the promotion of critical thinking. The module would be developed into a series of case studies with course specific scenarios to be used for group discussion, evaluation or role playing. These cases would then be incorporated within a course across the security curriculum to emphasize that ethics is universal phenomena rather than course specific topic. As several of the ITSY security courses are now part of other degree plans, this would allow this topic to be effective infused across the department’s curriculum. The achievement of a balance between “business process” education versus technology/technical training is another challenge. The commercial marketing of computer security packages superficially indicates that there are technical solutions that can be purchased and implemented. Most students prefer to learn the technology; however; the business process which involves “systems theory”, collaboration, team building, communications skills, service ethic and etc. poses a different perspective to the typical technology student who would rather work exclusively with the technology and play with hacking tools. Recognizing this tendency and acknowledging the work done by NWCET, the project’s curriculum developers have infused into all of the project’s ITSY courses various activities that focus on the broader business practices to include team projects, report writing and presentations, and role playing. The goal of these activities is to promote team building and emphasize the interpersonal skills which is being sought by business as well as to highlight the logistics support and enabling role that technology provides to business. Upon reviewing the number of females (15%) participating in the security program, it became readily evident that greater efforts are still needed to encourage and recruit women into the program. Promotional and recruiting materials had been obtained (from NSF) but not yet systematically promulgated into the public school system. Although recruitment has been a recent and frequent topic at the departmental faculty meetings, the “gender gap” had not been emphasized. This item has been placed onto the April agenda meeting. Institutionalization of the project beyond the grant’s three year funding time-line has already been initiated. These include: 1) the active recruitment of faculty that possess the security skills and knowledge 2) the inclusion of additional funding requirements for staff development and equipment procurement in the department’s annual budgeting cycle and 3) the expansion of the department’s facilities. The last of which encompassed the requisition and approval for a dedicated computer systems forensics 1,100 square foot lab which would also support digital forensics as part of a new 160,00 square foot complex which began on March 22, 2005. IV. Significant carry-over of funds (>20%) Year Two: The PI again reports a significant carry-over of funds in excess of 20% as the first year unobligated amounts cascaded into the second year. However; the specific funding amounts budgeted for the 12 month calendar year period for each of the budgeted categories were substantially obligated as projected in the initial grant proposal for year two. Significant for our project’s budget management and oversight is that Del Mar College on February 1, 2005 established a Grants Resource Development Office and recruited a staff accountant. This action will be a great help in tracking the project’s fiscal resources and obligations. The project received nearly $75,000 dollars in funding from the institution to purchase additional networking hardware and servers to support and add flexibility to the project. An additional $3,000 in staff development funds was also received. The institution has also modified its master building plan for its West Campus to incorporate the inclusion of a 1,100 square foot dedicated digital forensics lab for which the host facility (designated Emerging Technology Complex) had its dedication and ground breaking ceremony on March 22, 2005. Summary Year Two: The project PI evaluates that all second year objectives to have been substantially met with the exception of objective 5 (Develop learning modules) as this is one of the more significant project deliverable. Instructional design is iterative and time consuming in technical education for emerging technologies and the ever changing climate requires the constant monitoring of industry to insure the relevance of the knowledge, skills and attributes of the targeted occupation. The project’s external evaluator, Dr. Linerode, has made two fact finding site visits with the first in December 2004 and the second in March 2005. He is formulating his report of findings to be submitted under separate cover to NSF. The National Visiting Committee is once again scheduled to meet in early summer 2005. Activities - NVC Committee Meeting conducted June 18, 2004 - Collegiate Cyber Defense Competition, sending team to UTSA April 15,2005, DMC is sending an 8 member team to compete against UTSA, UT-Austin, TAMU, and UNT in a prototype 3 day network defense CPX - Partnered with TAMU on NSF proposal “The Cybersecurity Remote Education Access Toolkits (CREAT) submitted Feb 15, 2005 - 1st Annual Computer Security Symposium “Lock It Down”, to be conducted on April 29, 2005, 0830-1600 in conjunction with ESC 2, CC Chamber of Commerce - Partnering with UTSA, TAMU-CC, and City of Corpus Christi in MOA to conduct second phase of “Operation Dark Screen” CPX ‘04-‘05 Staff Training/Conference Attended or Completed 1. Abarca, David - EnCase Forensics, Introductory, Houston, TX, attended January 3-7, 2005 -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 2. Delassen, Jan -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 3. Fredericks, Patricia -“Spyware Exposed - WhatYou Should Know about the Growing Spyware Threat”, Computer Associates eSeminar, December 2004 -“Spyware Dissected: The Worst Spyware Programs on the Internet”, Computer Associates eSeminar, December 2004 4. Gonzalez, Gregory - SANSs Institute “Securing Unix”, Completed August 2004 - Working Connections IT Institute, “Intermediate Network Security”, July 1923, 2004 5. Harris, Michael -SANs “10 Domains of the CISSP Security” - Working Connections IT Institute, “Intermediate Network Security”, attended July 19-23, 2004 6. Hattox, David - EnCase Forensics, Introductory, Houston, TX, attended January 3-7, 2005 - Working Connections IT Institute, “Intermediate Network Security”, attended July 19-23, 2004 -“Information Assurance Symposium”, TAMU-CC, attended January 29. 2005 7. Kesterson, Brent -“Cyber Security Training...It’s in our Court!... Now what do we do with it?”, Texas Association of College Technical Educators, Fall Conference, Austin TX Oct, 2004 8. Knox, Warren - “Physical and Cyber Intrusions of Facilities and Networks”, ASIS meeting, December 15, 2004 -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 9. Lee, Larry - CISSP “Law, Investigation & Ethics” LearnKey - Security+, LearnKey - “Texas Infrastructure Protection Symposium”, UTSA, attended August 2004 -“Cyber Security Training...It’s in our Court!... Now what do we do with it?”, Texas Association of College Technical Educators, Fall Conference, Austin TX Oct, 2004 - “Physical and Cyber Intrusions of Facilities and Networks”, ASIS meeting, December 15, 2004 -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 10. Leja, Stan -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 11. Smith, Edward -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 12. Smith, Steven -“Cyber Security Training...It’s in our Court!... Now what do we do with it?”, Texas Association of College Technical Educators, Fall Conference, Austin TX Oct, 2004 -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 13. Stewart, Ken -Cisco Fundamentals of Network Security, completed July 2004 14. Upshaw, Susan - Working Connections IT Institute, “Intermediate Network Security”, July 1923 2004 -“Information Assurance Symposium”, TAMU-CC, attended January 29, 2005 15. Wilsker, Ira - “Identity Theft”, TCLEOSE - Intel Technology Conference “Wireless Security and War Driving”, June 22, 2004 - Infragard “Computer Forensics”, FBI, October, 2004 Future Training Planned 1. Sending 1 faculty member to “Faculty professional Development and Curriculum in Cyber Security”, Mimi- Dade/Virginia community College System, National Cybersecurity Consortium 2. Sending 1 faculty members to May 2005 Working Connections Institute, Dallas TX for Wireless Technology (Harris) 3. Sending 1 faculty member to May 2005 Working Connections Institute, Dallas TX for Case Studies Implementation (Upshaw) 4. Sending 1 faculty member to May 2005 Working Connections Institute, Dallas TX for Convergence Technology (Knox, Leja) 5. Sending 1 faculty members to SANS training, CISSP, and general security summer 05 (Smith) 6. Sending faculty member to CSI training in summer Operating Systems 05 (Hattox) 7. Sending faculty member SANS, General Security Track, summer ‘05 (Upshaw) Presentations and Outreach -ISD Presentations Banquette ISD, November 2004 Flour Bluff ISD, November 2004 Tuloso Midway ISD, Feb 2005 CCISD W.B. Ray HS, Mar 2005 South Texas Career Expo, Kingsville, TX April 2005 -“Identity Theft” interview by Wilsker, KBMT-TV, Jun 17, 2004 -“Identity Theft” presentation to Golden Triangle PC Club, Jul 11, 2004 -“Cyber Terrorism and Cyber Crime” by guest speaker Wilsker, Criminal Justice Educators, Jul 14-16, 2004 -“Implementing a Cyber Security Program” Austin Community College Divisional Meeting by Lee, August 2004 - “Phishing Scams” interview by Wilsker, KBMT-TV, Aug 12, 2004 - “Internet Scams and Phishing” by Wilsker, KBMT-TV, Sept 21, 2004 -“Using Cyber Security Command Post Exercises (CPX) to Identify Workforce Needs” by Lee at NSF ATI Conference, Washington D.C., Oct 14 2004 -“Cyber Security Training...It’s in our Court!... Now what do we do with it?”, Lee by & Smith Texas Association of College Technical Educators, Fall Conference, Austin TX Oct 7, 2004 “Computer Viruses and Spyware” by Wilsker, KFDM-TV, Nov 17, 2004 -“Cyber Stalking” by Wilsker, KFDM-TM, Jan 19, 2005 -“Cyber Forensics and Cyber Security” by Abarca, Hattox, Lee, Smith & Wilsker TCCTA Conference, Austin TX, Feb 18, 2005 -Cyber Terrorism and Computer Forensics” by Wilsker, Texas Center for Homeland Security Consortium, Feb 22, 2005 -North Harris Community College, April 25, 2005 by Lee and Wilsker -CyberSecurity and Computer Forensics Symposium “Lock It Down!” April 29th DMC CSIT Department