Designing an internet of things laboratory to improve student understanding of secure IoT systems

In response to an alarming shortage of workers in cybersecurity and a growing skills gap, the U.S. Department of Defense is taking steps to build cybersecurity capacity through workforce training and education. In this paper, we present an approach to address this shortage and skills gap through the development of cybersecurity education courseware for internet of things (IoT) applications.

To attract students and workers into the field of cybersecurity, it is important to design courseware that is exciting and tied to real-world problems. We describe our design for an embedded systems course taught at the graduate level for engineering and computer science students. The innovation in our approach is to select the fast-growing domain of healthcare and feature different IoT sensors that are seeing increased usage. These include barcode scanners, cameras, fingerprint sensors, and pulse sensors. These devices cover important functions such as patient identification, monitoring, and creating electronic health records. We use a password protected MySQL database as a model for electronic health records. We also demonstrate potential vulnerabilities of these databases to SQL injection attacks.

We administered these labs and collected survey data from the students. We found a significant increase in student understanding of cybersecurity issues. The mean confidence level of the students in cybersecurity issues increased from 2.5 to 4.1 on a 5-point scale after taking this course, which represents a 65% increase. The instructional lab material has been uploaded to the web portal https://clark.center designated by the National Security Agency for dissemination. Our approach, design, and experimental validation methodology will be useful for educators, researchers, students, and organizations interested in re-skilling their workforce.