This panel will help CS-trained educators who are teaching students about how to approach their work with an ethical mindset by discussing one of the key challenges in CS ethics education: how to manage authority in a classroom that focuses on values and ethics. Many CS instructors are wary of teaching either a dedicated ethics course or embedding responsible computing concepts and practices into their core CS courses because they feel that they lack disciplinary authority, or are even unsure of what precise teaching outcomes to aim for. These concerns are real: ethical reasoning is not the same type of skill set as is required in design or engineering work; it is a set of practices rooted in a person's beliefs, judgments, decisions, and values and it is necessarily personal for anyone who takes it seriously. Effective ethics course pedagogy and content are primarily about developing the students' capacity for reflection and inquiry, not transmitting knowledge. In an ethical reasoning focused learning environment, the majority of the work is persuading students that they can and should keep caring and thinking about the impact of their work beyond the classroom: in other words, the students must feel responsible for the reasoning and choices they make that will impact the lives of others. Through a discussion with multiple CS ethics educators, this panel will offer practical approaches to managing authority in this type of classroom as well as suggestions for engaging and empowering students to be curious and reflective about their own values and ethical positions.

The early web was built on static HTML or pages generated dynamically by the server. In both paradigms, the combination of HTML, CSS, and JavaScript was considered a specific platform rather than a core CS concept. In recent years, the nature of web development has shifted dramatically, emphasizing web applications that limit their dependency on server-side processing. Much of the content generation is handled in response to asynchronous execution of JavaScript. JavaScript is no longer just a language for writing event handlers; it now forms the core of client-side web development. This code must interact dynamically and asynchronously with complex backend processing systems. As such, modern web development is not as straightforward as using a server-side language to generate HTML text dynamically. It requires addressing a new computational paradigm, while also placing a greater emphasis on the user experience and accessibility. In our classes, we have observed the need to rethink how this part of our curriculum is structured. A one-semester course is no longer sufficient. We have also begun starting with JavaScript and the DOM as the native language of the web. In this birds-of-a-feather (BoF) session, we will exchange ideas on how this part of the curriculum is structured and how others approach teaching these courses.

With the 2018 revision of the ACM Code of Ethics and Professional Conduct, there is a growing interest in how computer science faculty can integrate these principles into the education of future practitioners. This special session illustrates one approach by highlighting assignments that blend ethics and technology. These assignments can be used in a variety of courses, including CS1, CS2, and later courses. Presenters will provide an overview of each assignment and gather feedback from the audience. All materials, including descriptions, starter files, and guidelines for instructors, will be published at https://ethics.acm.org/SIGCSE2020.

Introducing software testing has taken on a greater importance in undergraduate computer science curricula in the last several years, with many departments using JUnit or other testing frameworks in the programming sequence and software engineering courses. We have developed an automated framework for unit and integration testing and grading for our intermediate-level systems course projects. Our system--designed to test C programs--combines the Check unit testing framework, custom Bash scripts for integration testing, and the Valgrind Memcheck memory leak detection tool. Although our courses use Linux, the framework is platform-independent and has been tested on a variety of other platforms. We have used this framework for seven semesters with four different instructors as part of the computer science program at a primarily undergraduate university with an emphasis on liberal arts. We distribute both public and private tests so that students get immediate feedback on their progress without knowing the actual contents of every test. We have observed that knowing their code is not completely working motivates more students to figure out what they don't understand before the project deadline. It also gives students examples of different levels of tests to use to debug their code, encourages them to develop a deeper understanding of the project specification, and reduces student anxiety about grades.

This special session will involve three related components. It will begin with a history of the ACM Code of Ethics and Professional Conduct (the Code), its evolving presence in the computing curriculum guidelines over time, and its documented use outside of academe. This will lead into an overview of the major changes to the Code that occurred in the most recent update. The third component and primary focus of the session will be to work with participants to identify ways that ACM and the ACM Committee on Professional Ethics (COPE) can help Computer Science educators integrate the Code as broadly as possible into diverse programs, ranging from Kindergarten to PhD-level. The outcome of the session would be a preliminary set of guidelines for programs and departments to adopt the Code, potential challenges to be addressed when formalizing those guidelines, and suggested approaches to resolve these difficulties. If attendance is sufficiently large, we would adopt a jigsaw model, breaking into smaller focus groups that are tasked with distinct portions of the Code. Each group reports back at the end, and members of COPE will collate the results into a document for future distribution and work.

The goal of the OpenCSF project is to develop an on- line, interactive textbook focused on the Computer Systems Fundamentals (CSF) Core Tier 1 teaching objectives of the ACM 2013 Computing Curriculum. This area includes material that would traditionally be taught in courses such as Computer Organization, Operating Systems, Computer Networks, and Parallel & Distributed Systems. The CSF Knowledge Area highlights the most vital concepts and themes for these courses, emphasizing that this material should be core for all CS graduates. OpenCSF is built on the OpenDSA framework. This framework includes built-in capabilities for interactive activities designed to assess student reading comprehension. Furthermore, as a web-based resource, the intention of OpenCSF is to use HTML5 features to support interactive illustrations and exercises embedded along with the readings. Additionally, the OpenDSA framework supports integrating these activities with the Canvas Learning Management System to track student reading completion; this feature is not currently enabled in OpenCSF. At the time of this writing, drafts of five chapters have been written: Processes and OS Basics; Concurrency with IPC; Multithreading; Synchronization Primitives; Synchronization Problems. The goals for this lightning talk are to demonstrate these initial chapters, to discuss plans for future interactive components, and to gather feedback from those present. OpenCSF is publicly available at https://opencsf.org/.

The ACM Code of Ethics provides a framework for ethical conduct within the computing industry. The Code describes ethical conduct for individuals and organizations, as well as the basic moral principles underlying these prescriptions. Principles defined in the Code include: Avoid harm; be fair and take action not to discriminate; respect privacy; ensure the public good is the central concern during all professional computing work. While these principles are intuitive in many situations, students, faculty, and industry professionals often struggle to apply these concepts to computing. It is not obvious how to apply the concepts of harm, privacy, or the public good in courses on Operating Systems or Programming Languages, so discussion of the Code is often restricted to specialized Ethical Issues in Computing or Software Engineering courses. We believe this approach misses an educational opportunity to build on moral sensitivity--the ability to detect a potential moral problem within a particular context--as a foundation. Integrating the Code throughout the CS curriculum provides an opportunity to increase students' exposure to subtle moral dilemmas and improve their moral sensitivity. In this birds-of-a-feather (BoF) session, we will discuss: Which topics can be used to introduce ethical discussions into core Computer Science courses? How do you write and facilitate case study discussions? What other active learning techniques can be used to examine ethical issues? What concerns would faculty have in introducing ethical discussions into technical courses? What portions of the Code might be difficult for students and future practitioners to uphold?

Team-Based Learning (TBL) is an active learning pedagogy that involves a substantial amount of preparation work by students. While previous work shows that objective measures of student learning outcomes improved after TBL adoption in CS, little work has been done to evaluate the students' perspectives rigorously. In this work, we present the qualitative findings from a larger mixed-methods study of student perspectives. These results suggest that most students find TBL rewarding, although there are some aspects of the pedagogy that can be frustrating and may require alteration for TBL adoption in CS.

Before Fall 2013, our CS majors were required to take the same 4-credit introductory programming course as part of a two-semester CS1 designed to be welcoming to novices. As CS in K-12 has expanded, the diversity of incoming students' programming backgrounds has increased, raising concerns that the climate was becoming increasingly intimidating for novices. The literature suggests these effects could disproportionately impact retention of female students and other underrepresented minorities, undermining other efforts to broaden participation in computing. To address these concerns, we split the first course based on students' prior programming experience. Using statistical techniques, we analyzed the intermediate quantitative impact of this and other curricular changes. Our results suggest that adding the alternative CS1 course had little effect on retention, but the overall structure has been successful in achieving comparable CS2 outcomes regardless of prior experience.

There is significant evidence that active learning techniques facilitate superior learning outcomes when compared to traditional lecture-based techniques. However, adopting an entirely new pedagogy is a time-consuming endeavor that requires considerable effort. In this work, we describe simple transitional steps that we used to increase the amount of active learning in our Operating Systems (OS) course. After introducing these techniques in the Fall 2013 offering of this course, we observed dramatic improvements in a variety of measures of student outcomes, including withdraw-D-failure (WDF) rates and final exam performance. We also observed marked improvement in project completion rates. Our results suggest that adopting components of active learning pedagogies can contribute to positive outcomes with modest investments in time and effort.

This paper summarizes our experiences restructuring a core portion of our required courses for majors. Internal and external reviews of our program highlighted areas of concern in our "systems core," including inconsistent student outcomes, missing required material, and inadequate opportunities for programmatic assessment. To fix these problems, we initiated a curricular review to redesign these courses. Our novel approach employed a process known as backward course design that starts with desired student outcomes and works backward toward defining content coverage. By extending this design approach to our curriculum as a whole, we have defined a new systems core structure that has tightly integrated curriculum assessment opportunities. The result is a new systems core that changes almost 1/3 of the required courses for the major. This new structure provides increased student control over their learning goals while defining a consistent foundation of systems fundamentals; it also has tightly integrated program objectives and assessments. Applying the backward design philosophy to the curriculum, rather than to a single, pre-defined course, is both a rewarding and challenging experience. In this paper, we describe this approach, summarize the results of the process, and map the outcomes to the ACM 2013 curriculum. We also provide advice and lessons learned for others who may consider such an undertaking.

No abstract available.

Code-reuse attacks, such as return-oriented programming (ROP), are a class of buffer overflow attacks that repurpose existing executable code towards malicious purposes. These attacks bypass defenses against code injection attacks by chaining together sequence of instructions, commonly known as gadgets, to execute the desired attack logic. A common feature of these attacks is the reliance on the knowledge of memory layout of the executable code. We propose a fine grained randomization based approach that breaks these assumptions by modifying the layout of the executable code and hinders code-reuse attack. Our solution, Marlin, randomizes the internal structure of the executable code by randomly shuffling the function blocks in the target binary. This denies the attacker the necessary a priori knowledge of instruction addresses for constructing the desired exploit payload. Our approach can be applied to any ELF binary and every execution of this binary uses a different randomization. We have integrated Marlin into the bash shell that randomizes the target executable before launching it. Our work shows that such an approach incurs low overhead and significantly increases the level of security against code-reuse based attacks.

There is a growing body of evidence showing active learning pedagogies are effective for ensuring long-term student learning, reducing course failure rates, and retaining majors. While active learning pedagogies are more often employed in lower divisional CS courses, systems classes-such as OS, architecture, and networks-are just beginning to see a shift from standard lecture to active learning. This BOF will provide a forum for sharing ideas of how to integrate active learning techniques into systems courses, using the following questions as starting points:

Code-reuse attacks, including return-oriented programming (ROP) and jump-oriented programming, bypass defenses against code injection by repurposing existing executable code in application binaries and shared libraries toward a malicious end. A common feature of these attacks is the reliance on the knowledge of the layout of the executable code. We propose a fine grained randomization based approach that modifies the layout of executable code and hinders code-reuse attack. Our solution consists solely of a modified dynamic loader that randomizes the internal structure of the executable code, thereby denying the attacker the necessary apriori knowledge for constructing the desired sequence of gadgets. Our approach has the advantage that it can be applied to any ELF binary and every execution of this binary uses a different randomization. We describe the initial implementation of Marlin, a customized loader for randomization of executable code. Our work shows that such an approach is feasible and significantly increases the level of security against code-reuse attacks.

To combat the threat of information leakage through pervasive access, researchers have proposed several extensions to the popular role-based access control (RBAC) model. Such extensions can incorporate contextual features, such as location, into the policy decision in an attempt to restrict acces

Modern computer systems are built on a foundation of software components from a variety of vendors. While critical applications may undergo extensive testing and evaluation procedures, the heterogeneity of software sources threatens the integrity of the execution environment for these trusted programs. For instance, if an attacker can combine an application exploit with a privilege escalation vulnerability, the operating system (OS) can become corrupted. Alternatively, a malicious or faulty device driver running with kernel privileges could threaten the application. While the importance of ensuring application integrity has been studied in prior work, proposed solutions immediately terminate the application once corruption is detected. Although, this approach is sufficient for some cases, it is undesirable for many critical applications. In order to overcome this shortcoming, we have explored techniques for leveraging a trusted virtual machine monitor (VMM) to observe the application and potentially repair damage that occurs. In this paper, we describe our system design, which leverages efficient coding and authentication schemes, and we present the details of our prototype implementation to quantify the overhead of our approach. Our work shows that it is feasible to build a resilient execution environment, even in the presence of a corrupted OS kernel, with a reasonable amount of storage and performance overhead.

Several models for incorporating spatial constraints into role-based access control (RBAC) have been proposed, and researchers are now focusing on the challenge of ensuring such policies are enforced correctly. However, existing approaches have a major shortcoming, as they assume the server is trustworthy and require complete disclosure of sensitive location information by the user. In this work, we propose a novel framework and a set of protocols to solve this problem. Specifically, in our scheme, a user provides a service provider with role and location tokens along with a request. The service provider consults with a role authority and a location authority to verify the tokens and evaluate the policy. However, none of the servers learn the requesting user's identity, role, or location. In this paper, we define the protocols and the policy enforcement scheme, and present a formal proof of a number of security properties.

Cryptographers have proposed the notion of read-once keys (ROKs) as a beneficial tool for a number of applications, such as delegation of authority. The premise of ROKs is that the key is destroyed by the process of reading it, thus preventing subsequent accesses. While the idea and the applications are well-understood, the consensus among cryptographers is that ROKs cannot be produced by algorithmic processes alone. Rather, a trusted hardware mechanism is needed to support the destruction of the key. In this work, we propose one such approach for using a hardware design to generate ROKs. Our approach is an application of physically unclonable functions (PUFs). PUFs use the intrinsic differences in hardware behavior to produce a random function that is unique to that hardware instance. Our design consists of incorporating the PUF in a feedback loop to make reading the key multiple times physically impossible.

In a distributed computing environment, remote devices must often be granted access to sensitive information. In such settings, it is desirable to restrict access only to known, trusted devices. While approaches based on public key infrastructure and trusted hardware can be used in many cases, there are settings for which these solutions are not practical. In this work, we define physically restricted access control to reflect the practice of binding access to devices based on their intrinsic properties. Our approach is based on the application of physically unclonable functions. We define and formally analyze protocols enforcing this policy, and present experimental results observed from developing a prototype implementation. Our results show that non-deterministic physical properties of devices can be used as a reliable authentication and access control factor.

As mobile computing devices are becoming increasingly dominant in enterprise and government organizations, the need for fine-grained access control in these environments continues to grow. Specifically, advanced forms of access control can be deployed to ensure authorized users can access sensitive resources only when in trusted locations. One technique that has been proposed is to augment role-based access control (RBAC) with spatial constraints. In such a system, an authorized user must be in a designated location in order to exercise the privileges associated with a role. In this work, we extend spatially aware RBAC systems by defining the notion of proximity-based RBAC. In our approach, access control decisions are not based solely on the requesting user's location. Instead, we also consider the location of other users in the system. For instance, a policy in a government application could prevent access to a sensitive document if any civilians are present. We introduce our spatial model and the notion of proximity constraints. We define the syntax and semantics for the Prox-RBAC language, which can be used to specify these policy constraints. We introduce our enforcement architecture, including the protocols and algorithms for enforcing Prox-RBAC policies, and give a proof of functional correctness. Finally, we describe our work toward a Prox-RBAC prototype and present an informal security analysis.

As the use of peer-to-peer (P2P) services for distributed file sharing has grown, the need for fine-grained access control (FGAC) has emerged. Existing access control frameworks use an all-or-nothing approach that is inadequate for sensitive content that may be shared by multiple users. In this pape

Proposed models for spatially-aware extensions of role-based access control (RBAC) combine the administrative and security advantages of RBAC with the dynamic nature of mobile and pervasive computing systems. However, implementing systems that enforce these models poses a number of challenges. As a solution, we propose an architecture for designing such a system. The architecture is based on an enhanced RBAC model that supports location-based access control policies by incorporating spatial constraints.

The paper first discusses motivations why taking into account location information in authentication and access control is important. The paper then surveys current approaches to location-aware authentication, including the notion of context-based flexible authentication policies, and to location-aware access control, with focus on the GEO-RBAC model. Throughout the discussion, the paper identifies open research directions.