# Introducing Research into the Undergraduate Curriculum in Cybersecurity

Dimitrios Damopoulos, Susanne Wetzel

<figure><img src="image_1.png" /></figure>

## To cite this version:

Dimitrios Damopoulos, Susanne Wetzel. Introducing Research into the Undergraduate Curriculum in Cybersecurity. 12th IFIP World Conference on Information Security Education (WISE), Jun 2019, Lisbon, Portugal. pp.30-42, 10.1007/978-3-030-23451-5_3 . hal-02365731

HAL Id: hal-02365731

https://inria.hal.science/hal-02365731

Submitted on 15 Nov 2019

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>
# Introducing Research into the Undergraduate Curriculum in Cybersecurity

Dimitrios Damopoulos and Susanne Wetzel

Stevens Institute of Technology
Department of Computer Science
Castle Point on Hudson
Hoboken, NJ 07030, USA
{ddamopou,swetzel}@stevens.edu

**Abstract.** In this paper, we describe a new approach for introducing a research experience based on real-world research problems into the two semester Senior Design course sequence of the B.S. in Cybersecurity program at Stevens Institute of Technology as part of the INSURE consortium. We discuss the necessity of such a research experience in the context of the ever-changing nature of Cybersecurity in that attacks seen and countermeasures developed today may already be different and outdated tomorrow. We also detail the insights gained, challenges encountered, and lessons learned in order to provide the community with the necessary means to use this as a model to implement a research experience as part of other undergraduate Cybersecurity degree programs.

**Keywords:** Research · Cybersecurity · Bachelor Degree · Senior Design Course Sequence.

## 1 Introduction

In the recent past, an increasing number of four-year institutions in the United States started dedicated undergraduate programs in Cybersecurity. In the past, degree programs focused on Cybersecurity were mostly available on the graduate level—often building on undergraduate degrees in computing, engineering, or business—or Cybersecurity was offered as a possible concentration in the context of other traditional undergraduate degree programs—most prominently in Computer Science, Computer Engineering, Mathematics, or Business.

The main benefit of a dedicated undergraduate degree program in Cybersecurity is in that it allows for a greater focus on Cybersecurity content—both in terms of depth and breadth. Consequently, students have more opportunities and options to select a focus within Cybersecurity to pursue their specific interests. Generally, this approach allows for a more comprehensive education in Cybersecurity and is thus assumed to better prepare students for a career in Cybersecurity—already by means of an undergraduate degree. This is particularly important considering the fact that in the US the majority of students pursuing an advanced degree in computing-focused fields are non-domestic
## 2 INSuRE

The INSuRE research collaborative is a self-organizing, cooperative, multi-disciplinary, multi-institutional, and multi-level research collaboration of National Centers of Academic Excellence in Cyber Defense Research (CAE-R) and Cyber Defense Education (CAE-CDE) universities [5, 4, 14, 15] that “cooperate to engage students in solving applied Cybersecurity research problems”. The Center of Academic Excellence in Cyber Defense Research (CAE-R) designation was launched in 2008 with the purpose to increase the understanding of “robust Cyber Defense technology, policy, and practices that will enable our nation to effectively prevent or respond to a catastrophic cyber event” [6]. The CAE-R designation recognizes universities for their institutional excellence in Cybersecurity research. The vision for the program was to “establish a process that will present opportunities for Cyber Defense research centers to drill deeper into much needed solutions to securing the global information grid and provide NSA, DHS, and other federal agencies with insight into academic Cyber Defense programs that can support advanced academic research and development capabilities” [6]. However, until INSuRE was launched, these government agencies did not have an effective means to tap into the expertise within the CAE-Rs—except for working with some faculty or institutions on an individual basis.

Starting with one university and one government agency in Fall 2012, INSuRE has since grown into a collaboration of 20+ universities (holding the CAE-R or CAE-CD designations) with many government agencies and labs (on both the federal and local levels)—which suggest the real-world research problems in Cybersecurity (of national interest and need) and provide technical oversight to the student teams. Over the years, the INSuRE partners have worked on more than 100+ distinct research problems resulting in more than 150 project reports, involving hundreds of students across the participating universities—many of whom have subsequently been hired into government jobs. The effort has resulted in refereed conference publications and published data sets (e.g., [11–13]).

Since the beginning, Purdue University has been the central point and coordinating entity of INSuRE. All participating universities follow a common schedule (possibly with minor local adjustments due to the institution's semester schedule). The coordinating faculty at Purdue solicit research problems from the participating government agencies and labs and make them centrally accessible to all participating universities. In turn, universities locally recruit students to participate. Throughout the semesters, there are various milestones that are coordinated across all universities:

**Bids:** The first major milestone that all students have to complete is the bidding on a number of the contributed research problems. In particular, all students are asked to review the descriptions that the Technical Directors provided for the research problems they contributed. For at least two research problems the students are interested in, they are then asked to write and submit a brief (two-to-three paragraph) statement on why they are interested in this
problem, what excites them about the problem, what they see as possible directions for their project, and why they feel they are qualified to carry out the project. The INSuRE coordinator reviews the bids submitted by all students from all the participating institutions and assigns the students to research problems. In doing so, the coordinator seeks to strive a balance of covering as many research problems and Technical Directors as possible while recognizing the student's interests and preferences as best as possible. Also, teams are typically formed at a participating institution—while teams across institutions are possible and have been done.

**Project Proposal:** Once project teams have been formed, the teams prepare a project proposal that outlines the team's ideas, directions, milestones, distribution of work, etc. for their project to address the assigned research problem. This also includes an initial literature review. Typically, the teams are in close contact with the Technical Director who contributed the research problem while preparing the project proposal. Oftentimes, Technical Directors phrase the descriptions of their research problems in such a fashion that many different directions and deliverables for a project are possible. The purpose is to allow the students to develop their own ideas and shape their project. Once completed, the Technical Director reviews the project proposal—possibly asking for changes or additions as needed. Once the Technical Director approves the project proposal, the team starts working on the project, executing its plan.

**Midterm Deliverables:** About half way through the semester, each team prepares a report and a slide deck documenting the current status of their projects. All reports and slide decks are shared with everyone (i.e., all participating institutions and Technical Directors) through the common project platform. In addition, all teams are scheduled to give a midterm presentation—facilitated through WebEx sessions (arranged for by the coordinators at Purdue University). Any participating institution, their teams and students, as well as all Technical Directors may participate in these WebEx sessions. These open sessions provide everyone with a unique learning opportunity on a large variety of projects on current topics (including their state-of-the-art, open issues, results achieved, etc.)—almost like a conference in Cybersecurity that is covering topics across the entire spectrum.

**End of the Semester Deliverables:** Similar to the Midterm Deliverables, the teams prepare reports and slide decks to comprehensively document their results at the end of the semester. Once again, these documents are shared with everyone and the respective final presentations are facilitated through WebEx.

All offline interactions and data sharing are handled through a central platform—referred to as INSuREHub [4, 14, 15]. While the coordinators maintain the central components (including the uploading of the research problem sets, semester schedules, etc.), each institution has a dedicated space on INSuREHub where deliverables are uploaded and can be accessed not only by the Technical Directors co-supervising the projects but the INSuRE community at large.
It is important to note that it is not unusual for a Technical Director to offer the same research problem for multiple semesters as a single semester might not be enough time for a team to comprehensively address all facets of a specific research problem. Teams who are assigned to a research problem that has been offered and worked on before have access (through the INSuREHub) to the previous deliverables of these teams (i.e., Project Proposals, Midterm and End of the Semester Deliverables) and may use these as a jump-off point for their own projects. Consequently, there have been research problems that have been worked on for multiple semesters and have seen contributions from various teams leading to a wealth of directions and results over time [15].

In addition to the milestones that are the same across all participating INSuRE institutions, there may be additional ones that individual institutions implement. For example, many (including Stevens) also require the following:

**Weekly Dashboards:** Each week, the teams are required to submit a two-page slide deck that reviews the status of the project. In particular, as part of their slide deck, the teams discuss the progress they have made during the past week, whether they have encountered any challenges, or whether they have any questions. In addition, each team member reviews what s/he worked on, what s/he individually contributed and delivered to the project, and what s/he is planning in terms of both activities and deliverables for the coming week. The teams also present these dashboards in class—where they also demo the code, review submitted deliverables, and field questions from the instructors and other classmates. The Weekly Dashboards are made available to the Technical Directors in order to keep them updated on the projects. The dashboards also serve as input and basis for the regularly scheduled meetings with the Technical Directors.

**Regular Check-in with Technical Directors:** Regular meetings (e.g., conference calls) are scheduled with the Technical Directors—ideally during the weekly class time(s). As part of these meetings, the students report on their progress, ask questions, and provide the Technical Directors with the opportunity to give input and shape the projects as needed and desired.

# 3 Structure of INSuRE in the Context of Senior Design

In implementing INSuRE in the context of a two semester Senior Design course sequence during the Senior year of our B.S. in Cybersecurity degree program at Stevens Institute of Technology [1], we had to make some adjustments to the typical deliverables when offering INSuRE as a single course for one semester only (as described above). In particular, this pertains to defining effective means to connect the two semesters—especially regarding the typical beginning of the semester elements such as the Bids and Project Proposal which are not necessary for the second semester. Instead, we included a milestone to connect back with the Technical Directors and added a Project Realignment milestone:

**Project Status Updates:** Instead of the Midterm and End of the Semester Deliverables, we adjusted the two semester schedule to include a total of
three Project Status Update milestones, coinciding with the Midterm and
End of the Semester Deliverables of the first semester and the Midterm De-
 liverables of the second semester. For both the second and the third updates,
we require that these status updates build on the previous update and that
the respective slide decks and reports are updated and extended on cor-
respondingly to properly reflect the project progress since the last status
update. Similarly, with each status update we request that the timeline and
deliverables going forward are adjusted as needed.

**Project Realignment:** During the second semester of the two semester sequence of the project, we have adjusted the schedule replacing the Bids and the Project Proposal with a Project Realignment milestone. In most cases, this goes hand in hand with the next newly introduced milestone, namely the facilitating—if possible—of an in-person meeting with the Technical Director. Typically, the Project Realignment milestone is scheduled after such in-person meetings with the Technical Directors and after the first few class meetings have been completed in order to give the students enough time to discuss matters and plan the second semester (including other milestones, deliverables, and assignments of responsibilities to team members) accordingly.

**Project Meeting with Technical Director:** We were fortunate that we were awarded a grant to support the development and introduction of INSuRE in the context of the Senior Design course sequence of our B.S. in Cybersecurity program at Stevens. In particular, the grant included funding to hold in-person meetings of the teams with the Technical Directors of their project. We arranged for the meetings to take place either right before or at the very beginning of the second semester—thus constituting an integral part of the overall realignment process of the project. Depending on the schedules of the Technical Directors, the meetings typically lasted 2-4 hours and included demonstrations and presentations by the teams, as well as in-depth discussions with the Technical Directors on the progress made during the past semester and plans for the semester ahead.

**Optional Extra-credit Assignments:** It is not unusual for students to ask for extra-credit assignments in order to boost their grades. To facilitate such requests and yet make it fair to all students in the class, we have designed a set of assignments that all students can take advantage of. In particular, in the first semester we offered a group assignment for the teams to start early with the planning for the second semester of the two semester Senior Design course sequence. In addition, we gave individual team members the opportunity to work on the project over the break in between the two semester and earn extra-credit for doing so in both semesters (for planning the work to be done at the end of the first semester and reporting on the completed work at the beginning of the second semester).

**Grading:** Most of the deliverables were graded on a per team basis. The only exception was the Weekly Dashboards where the weekly deliverables and planning include a major individual grading component. This was done on
purpose in order to give each team member the opportunity to show his/her
individual contributions and distinguish himself/herself beyond the team's
performance.

**Program Context:** Stevens Institute of Technology was one of the first institutions in the US to offer a dedicated degree program in Cybersecurity on the undergraduate level. The program was approved in 2006 and had its first class graduating in 2011.

The B.S. in Cybersecurity program at Stevens [1] includes strong core re-
quirements in Computer Science and Mathematics as well as an extensive set
of courses covering a broad spectrum of Cybersecurity aspects (including Cryp-
tography, Privacy, System Security, and Law). In addition, students may select
electives from a wide range of Computer Science of Cybersecurity courses.

The two semester Senior Design course sequence at Stevens is to be "the cul-
mination of the undergraduate experience, where knowledge gained in the class-
room is applied to a major design project" [8]. In the past, Cybersecurity majors
completed their Senior Design course sequence together with the Computer Sci-
ence majors. However, many Cybersecurity majors expressed great frustration
and dissatisfaction as the typical Computer Science Senior Design projects had
too little Cybersecurity content. Instead, their efforts had to mostly focus on
software development aspects. In order to address this shortcoming, we decided
to offer a dedicated Senior Design course sequence for our Cybersecurity ma-
jors. The goal was to allow the Cybersecurity majors to apply the Cybersecurity
knowledge, skills, and abilities they had acquired in their course work in the
context of a comprehensive, challenging, real-world Cybersecurity project. We
feel that implementing the Senior Design course sequence as part of INSuRE is
especially well-suited to meet this goal.

## 4 Discussion: Challenges Encountered and Lessons Learned

In the past, Stevens offered INSuRE in the more traditional setting as it is to
be found across most of the institutions participating in the consortium over
the years. Specifically, the course was offered as an elective course (either as
independent study course or special topics course) with some/all team mem-
bers pursuing a Cybersecurity degree program or concentration in a computing-
focused degree program on the graduate level (for more details see [4, 14, 15]).
Consequently, there are two major differences to the newly implemented Senior
Design sequence in the context of INSuRE:

**Elective vs. Required Course(s):** For elective courses, students typically choose courses that best meet their expectations—typically including factors such as their own experience, interest in the topic, anticipated workload, instructor, timing, etc. In general, students taking the elective have made a deliberate decision to take the course. This is very different in case of a
required course where students have no choice but complete the course in order to meet graduation requirements. In turn, it means that a required course will include a cross-cutting spectrum of students (w.r.t. strengths, weaknesses, and proficiency).

**Undergraduate vs. Graduate Students:** Typically, graduate students are more advanced, have more experience, or more generally are more mature. While not a must, these traits at the very least can prove very beneficial when working in a team, dealing with the unknowns and challenges of a research problem, and working under tight time constraints.

In this context we now discuss challenges we have encountered and lessons learned in offering the two semester course sequence for the past two academic years. When possible, we indicate changes we introduced for the second teaching in response to the challenges encountered in teaching the sequence for the first time. For some of the challenges we have not yet introduced any countermeasures as they may need more investigation or implementing solutions may also require some non-trivial changes to the Stevens' B.S. in Cybersecurity curriculum [1].

**Typical Student Work Pattern:** Many of today's (undergraduate) degree programs in the US seem to be structured such that students can succeed by solely focusing on and working towards the typical course deliverables that come with a (hard) deadline—many of which are now scoped such that students can still complete them rather last minute if they just put in some major effort right before such a deadline. This holds true especially for homeworks and in some cases even exams. This pattern proves a major challenge in the context of this Senior Design course sequence.

Specifically, such a research-oriented implementation of the Senior Design course sequence requires that all students in the team consistently work on the project every week. Last minute power work does not prove effective and does not lead to the progress necessary and expected—especially also by the Technical Directors. It proves extremely challenging to get the students to change their work pattern—even though multiple measures have been introduced to at least enforce some of it. This includes that the students must develop a timeline as part of the Project Proposal—which they are required to adjust for each Status Update and as part of the Project Realignment milestone. Furthermore, the Weekly Dashboards are meant to instill some level of regular accountability—forcing the students to report on the work they have completed in the past week and plan ahead for the coming week. Still, we have continuously experienced that students deviate from these plans—especially at times where they have major deliverables or milestones in other classes (e.g., homeworks or midterm/final exams). Students seem to think that there is enough flexibility in this Senior design course sequence that allows them to make up for working less one week by putting in more time during a subsequent week. Clearly, the students underestimate ripple effects and the dependency as well as impact on other team members.

We have experienced that holding the students accountable to the deliverables they have committed to for certain dates (e.g., by deducting points for not
meeting them in time) can lead to a lot of tension and complaints. Students tend to do things their way, i.e., the way they have done it in the past and continue to successfully do it for other courses. While some express their dissatisfaction openly, others only do so in the course assessment at the conclusion of the term.

**Senior Design Sequence in the Curriculum:** Related to the previous matter is the fact that the two semester Senior Design course sequence merely accounts for one of the five three-credit courses that the students are scheduled to take during each semester of their Senior year.<fnref n="1" /> Consequently, there is a natural limit on the amount of time that the students can realistically spend working on their Senior Design project. While the expected time commitment outside of the classroom is 6-9 hours per week for a three credit course, in reality students devote a decreasing amount of time on a course with an increasing number of courses they are enrolled in. Given the experience of the first teaching of the two semester sequence with the "*I did not spend much time on the project because it was a busy week with other classes*", for the second teaching we increased the focus on the Weekly Dashboards seeking to hold the students more accountable to the timelines they have committed to.

**Research Methods:** Most of the undergraduate students have no major experience in project work other than software development at a small scale or based on typical textbook problems. Furthermore, the main goto source in case of questions is Wikipedia. Even when provided with research papers along with instructions on how to search for papers they cite and papers they are cited by in order to get a comprehensive picture of the topic, by and large the students seem to lack the patience to do so. Also, we experienced a tremendous resistance to thoroughly studying the papers and documenting findings through brief write-ups that can be reviewed by the whole team. Instead of spending some time to comprehensively explore a topic and available resources, we noticed that students would rather just revert to trying things out or coding something up quickly (possibly also to demonstrate activity and produce some results). At this point we can only speculate what the reason is for this—possibly attesting it also to how students have been conditioned—i.e., regurgitate materials instead of making them transfer knowledge to unknown problems.

Once again, we used the Weekly Dashboards during the second teaching of the two semester course sequence in order to force some change in behavior. Specifically, we made the students report on the papers they have read and make them submit short summaries that also discuss what other literature they found based on what they read and what needs to be reviewed next. Similarly, we have used the Weekly Dashboards and the class time where students present their progress to challenge the rapid prototyping and development directions

<footnote n="1">¹ It is important to note that many of our students elect to overload during their Junior and Senior years—pursuing both a Bachelor and Masters degree program in parallel. Such an increased workload just further exacerbates the problem at hand in terms of time commitment and time management.</footnote>
the students prefer to take. In some cases we have even stepped in and not allowed the students to focus on coding until they finished at least some basic specification or mathematical description of the underlying problem.

As students progressed through the two semester course sequence, we noticed that students acquired more of a critical thinking and adopted a more structured approach.

**Expectations of Student, Faculty, and Technical Directors Interactions and Commitments:** Having Technical Directors from government agencies and labs suggest real-world research problems and co-supervise the teams (together with the faculty at the respective institutions) is a unique opportunity for the students and faculty alike. All parties can benefit tremendously from the interactions alone. However, we learned that this can also bring about challenges and friction. First and foremost, it is important for all to understand that it is a two semester commitment. We learned that it is important to explicitly address this out at the beginning of the first semester. Furthermore, it is important to align expectations. While some Technical Directors (especially those from government labs) may have extensive experience with summer interns, we have come to realize that it is important to manage expectations with regard to experience (which is different when working with undergraduate students versus graduate students) as well as the time commitment (a full-time intern versus a senior who is carrying a full load of classes and only one of which is the research-based Senior Design course sequence).

In turn, students are used to faculty being rather readily available—if not for an in-person meeting then at least by email. However, this is not necessarily the case for Technical Directors as participating in INSuRE is something that many of them do in addition to their usual job responsibilities. Consequently, it has proven rather challenging at times to manage requests for meetings and such. In particular, scheduling a meeting outside of the weekly class time by itself is a non-trivial challenge as individual team members typically have different class schedules and thus finding a common meeting time that works for the whole team, faculty advisors, and the Technical Director alike is generally extremely difficult.

Lastly, it is important to recognize that different Technical Directors not only have different backgrounds but also have different styles in overseeing projects. Some prefer to be hands-off and let the teams find their way—as a fresh set of minds may discover a promising and successful avenue that may lead to great results. Others are very hands-on and expect to see things done in a specific manner. As faculty we thus sometimes have to mediate matters accordingly.

**Problem Selection:** Another critical element is the selecting of a suitable research problem for the undergraduate student teams to work on for two semesters. It is a tradeoff between too easy (possibly mostly software development focused) versus too technically challenging (possibly even to the extent that the undergraduate students simply do not yet have the necessary background and the topic is too technical in order for the students to quickly get to
the level necessary to successfully master the project). Similarly, it is necessary
to pick a research problem that allows for a project that is comprehensive enough
to span a sequence of two semesters. In turn, if the problem is too extensive, the
challenge is to carve out a piece of suitable size that can be accomplished and
mastered in two semesters. In addition, there might be research problems that
are so tightly defined that students do not have much room to develop their
own ideas. In contrast, there may be problems that are so generally phrased
that while the students may find them interesting, they do not know where to
start and what to aim for. Overall, the right scoping is a major challenge. For
the second teaching, we pre-selected some problems for which the students were
allowed to submit bids. We are not sure yet whether we will continue with this
kind of an approach in the future. While it was easier for students to master the
bid phase, it is possible that some students would have better liked some of the
other research problems.

Orthogonal to the above is an observation we made after the bid phase for
the second teaching. While we had students bid on research problems enthu-
siastically, some then were stunned when they were actually assigned to these
problems. When asked why this came as a surprise, it became apparent that the
students had underestimated that stating interest could result in them being
assigned to the problem. Or more generally, it seemed that some students did
not fully grasp the magnitude and importance of the problem selection at the
onset and its impact not just for a short period of time (say days or weeks as
in case of deliverables in other classes) but that instead this constitutes a long
lasting commitment for a full academic year.

In general, in both years we have learned a lot and anticipate to continue to
learn more in future years. We expect that for some of the encountered problems
and challenges we will find good solutions over time that will then manifest
themselves in rules and directions. For others, we expect that we will need to
cope with them as they appear.

5 Conclusion and Future Work

Implementing INSuRE in the context of a two semester Senior Design course sequence has been exciting, challenging, and rewarding at the same time. Some of the challenges faced in the first two years were unexpected. Some of the changes introduced after the first year paid off, others still have to be reassessed. We expect that further adjustments and changes will be made based on the teaching of the two semester course sequence in its second year. For sure, we plan to explore different options of identifying potential projects (from the set of all offered projects) for our students to choose from.

Generally speaking, the experience of the past two years provides a positive
answer to the question raised above as to whether it is feasible to introduce
and carry out this kind of research experience in the context of a required two
semester sequence on the undergraduate level in an effective manner. First, there
are research problems contributed as part of INSuRE that can be carried out by
undergraduate student teams over a sequence of two semester. Second, the con-
tributed research problems are non-trivial thus requiring the students to apply
a wide range of knowledge, skills, and abilities they have acquired throughout
their course work. Third, it is possible for undergraduate students to make sub-
stantial progress and develop exciting new approaches to challenging research
problems.

In particular, over the past two years, our teams successfully carried out a
number of projects. For example, for the research problem of devising effective
countermeasures to phishing, one of our teams developed a new approach based
on visual similarity testing. The team implemented a browser plug-in, a back-
end testing tool, and carried out user studies to better understand user behavior
in the context of phishing. Another team worked on the research problem of
designing effective counter drone mechanisms. Specifically, the team worked on
classifying drones based on characteristics found in the 802.11 traffic of drones
networks.

Questions we cannot answer to date include whether teams with (some) grad-
uate students would have been able to develop better solutions (faster), whether
two semester projects generally result in more comprehensive solutions than
those of one semester projects, etc. In order to answer such questions one would
have to break with some key principles of INSuRE. In particular, it would be nec-
essary to assign various kinds of student teams (one semester vs. two semester,
all undergraduate vs. all graduate vs. mixed teams) to the same research prob-
lem, forcing them to pursue the same approach to allow for the comparability
of results. Most likely it would also be necessary to do this for a variety of re-
search problems in order to ensure that the results are not specific to a particular
research problem.

Going forward, we intend to carry out a comparative study (w.r.t. effec-
tiveness, difficulties, challenges, and success) with other educational systems
which introduce research components into the curriculum in other ways. For
example in Germany, students pursuing a Bachelors degree in Cybersecurity
or Computer Science at a university are typically required to write a Bachelor
thesis. The time frames allotted to complete this requirement vary—in some
cases it is three months in others it is up to six months. While working on
their thesis, students typically are not enrolled in classes and instead can focus
all their time and efforts on the project. Yet, a Bachelor thesis is typically
completed on an individual basis. Also, earlier in their studies, students are
often required to complete a seminar course in which they may already be
introduced to some research methods—in particular in conducting a thorough
literature search for a specific topic. We would like to investigate similarities
and difference in terms of challenges and opportunities. Questions we seek to
answer include: Does working in a group when first being introduced to research
make things easier or more difficult? Would increasing the number of credits
for the Senior Design courses (and thus decreasing the number of other courses
that students would take in parallel) improve the quality and outcomes of the
projects? How beneficial is it to expose students to some research methods
earlier in their studies—e.g., through a seminar course where students are
exposed to current research and are required to conduct a literature search?

**Acknowledgements:** The authors thank the INSuRE consortium—and in particular Melissa Dark and John Springer from Purdue University—for their continued support and guidance.

In part, this work was supported by the CAE Cybersecurity Workforce Ed-
ucation Grant # H98230-17-1-0342. Some of this work was carried out while
Susanne Wetzel was serving as Program Director for the Secure and Trustwor-
ty Cyberspace Program at the National Science Foundation.<fnref n="2" />

References

1. B.S. in Cybersecurity at Stevens Institute of Technology. https://www.stevens.edu/schaefer-school-engineering-science/departments/computer-science/undergraduate-programs/cybersecurity.

2. Foreign Students and Graduate STEM Enrollment. https://www.insidehighered.com/quicktakes/2017/10/11/foreign-students-and-graduate-stem-enrollment.

3. INSuRE at Dakota State University. http://dsu.edu/news/dsu-announces-insure-scholarship-recipients.

4. INSuRE Project. http://www.insurehub.org/.

5. National Centers of Academic Excellence in Cyber Defense. https://www.nsa.gov/resources/educators/centers-academic-excellence/cyber-defense/.

6. National Centers of Academic Excellence in Cyber Defense Research. https://www.nsa.gov/news-features/press-room/Article/1631722/nsa-and-dhs-announce-the-first-designees-of-the-national-centers-of-academic-ex/.

7. New Data Shows Expansion in Cybersecurity Worker Shortage. https://www.nist.gov/news-events/news/2018/06/new-data-shows-expansion-cybersecurity-worker-shortage.

8. Senior Design at Stevens Institute of Technology. https://www.stevens.edu/academics/undergraduate-studies/senior-capstone-projects.

9. US Lawmakers Introduce Bill to Fight Cybersecurity Workforce Shortage. https://www.zdnet.com/article/us-lawmakers-introduce-bill-to-fight-cybersecurity-workforce-shortage/.

10. Why are American Graduate Programs in Math, Statistics and CS Dominated by International Students? https://www.quora.com/Why-are-American-graduate-programs-in-math-statistics-and-CS-dominated-by-international-students.

11. Oluwatosin Alabi, Joe Beckman, Melissa Dark, and John Springer. Toward a Data Spillage Prevention Process in Hadoop Using Data Provenance. In *Proceedings of the 2015 Workshop on Changing Landscapes in HPC Security (CLHS)*, 2015.

<footnote n="2">² Any opinion, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.</footnote>
12. Thiago Alves, Rishabh Das, and Thomas Morris. Virtualization of Industrial Control System Testbeds for Cybersecurity. In *Proceedings of the 2Nd Annual Industrial Control System Security Workshop (ICSS)*, 2016.

13. Sandeep Nair, Sudip Mittal, and Anupam Joshi. OBD SecureAlert: An Anomaly Detection System for Vehicles. In *IEEE Workshop on Smart Service Systems (SmartSys)*, 2016.

14. Alan T. Sherman, Melissa Dark, Agnes Chan, Rylan Chong, Thomas Morris, Linda Oliva, John Springer, Bhavani M. Thuraisingham, Christopher Vatcher, Rakesh M. Verma, and Susanne Wetzel. INSuRE: Collaborating Centers of Academic Excellence Engage Students in Cybersecurity Research. *IEEE Security & Privacy*, 15(4):72-78, 2017.

15. Alan T. Sherman, Melissa Dark, Agnes Chan, Rylan Chong, Thomas Morris, Linda Oliva, John Springer, Bhavani M. Thuraisingham, Christopher Vatcher, Rakesh M. Verma, and Susanne Wetzel. The INSuRE Project: CAE-Rs Collaborate to Engage Students in Cybersecurity Research. CoRR, abs/1703.08859, 2017.