Cyber Kill Chain

There is a demand for Cyber Security IT professionals, so I am updating my knowledge of the area to help teach this. Last year I presented a "Cyberwar: Hypothetical for Teaching ICT Ethics", about a confrontation in the South China Sea.

Cyber Kill Chain

Lockheed Martin offer a Cyber Kill Chain^® framework for cyber security. For those not familiar with the aggressive terminology  of the military, such terms can sound confronting, but the "kill chain" from which Lockheed Martin's propitiatory framework is derived is simply the military version of a decision making loop: first investigate the problem, then select a course of action, act and then assess the results before going around the loop again.

Some of the research carried out by the military is in the public domain. Australia's Defence Science and Technology Organisation (DSTO ) produce occasional papers on cyber security. One is McNally, Yiu, Groveand Gerhardy's "Fuzzing: the state of the art" (2012). As the authors explain, fuzzing is a software testing technique which uses test data generated by one program to test  another program. This can be used, for example, for penetration testing, where many tests of passwords could be used to see if access is gained to a system.

 This paper starts with the origins of the technique for testing UNIX utilities at University of Wisconsin-Maddison by  Professor Barton Miller’s students. The paper provides a detailed discussion of more recent techniques. This is perhaps a little too detailed. Like many DSTO papers, at 55 pages, this is more than you need for a brief overview, so the casual reader might want just the introduction and conclusion.

References

McNally, R., Yiu, K., Grove, D., & Gerhardy, D. (2012). Fuzzing: the state of the art (No. DSTO-TN-1043). DEFENCE SCIENCE AND TECHNOLOGY ORGANISATION EDINBURGH (AUSTRALIA). Retrieved from http://www.dtic.mil/dtic/tr/fulltext/u2/a558209.pdf

Is the Growth in Australian International Education Sustainable?

Simon Birmingham, the Minister for Education and Training, has pointed to "... surging international student numbers.. " at Australian institutions, up 15% on March 2016. However is this growth rate sustainable? Can Australian institutions provide instructors, facilities and the quality of education, with this growth rate? What are the risks from depending on students from a few countries?

The International Student Data Monthly Summary from the Department of Education and Training shows 30% of the students are from China and 11% India. A dispute with China in particular (such as conflict over the South China Sea), resulting in a loss of students, would have a significant effect on Australian institution's finances.

While universities get most of the media attention, this is only just only half of the international students at 54%. Vocational Education and Training (VET) sector makes up 23%. While VET is growing at the same rate as universities (15%), I suggest there is scope for more growth in this sector. The challenge is to provide VET training which governments and employers in the region will find credible. If Australian VET providers can find a way to convince stakeholders that students actually undertook the training and are competent to the level certified, this sector could expand. This may require techniques similar to the livestock export industry, where there is individual tracking.

Just as a consumer of premium beef can see which farm a steak came from and the details of the farmer, credible VET certification may require the employer to see who trained the applicant in what, when and perhaps even video of the applicant undertaking their training and assessment.

The other threat to Australian's inbound international education industry is, of course, on-line learning. At present on-line courses, are not seen as a premium product, with questions over the quality of the education and the integrity of the assessment system. The VET sector could help change this perception, with its results based approach to training and assessment and flexibility.

Australian universities have recently experimented with vocationally relevant skills, micro-credentials and competency based assessment, but these have been routine in the VET sector for decades. It is much easier to convince an employer than a VET graduate has the required skills for a job, where there is a list of skills specific to that job, every one of which the student has been certified competent in. In contrast, a university graduate may, or may not, have been tested against some of a list of vague aspirational goals listed for a degree.

However, Australia suffers from its divided higher education system which sees universities separated from VET and no education focused institutions to fill the gap in between. Solving this problem is the key to further expansion of international education and lowering the cost of domestic higher education.

EduTECH in Sydney 8 and 9 June 2017

The EduTech 2017 is on at the new exhibition centre in Sydney 8 and 9 June. I enjoyed speaking and chairing at the Tertiary Education IT Leaders stream of EduTech in Brisbane last year. This event has a free exhibition as well as streams for educators (and parents) from K to Vocational/University and Librarians.

This year I will be taking a less active role* and probably will just go to Ed 2030 (11:20am) and Systems Innovation (11:40am). Apart from that I will be wandering around the exhibition seeing what to blog for Higher Ed Whisperer. Anyone with something new and interesting for the blog, please let me know.

* I have volunteered to be on standby if they need a chair or speaker.

Australian USI Transcript Service: Is it any use?

Karen Andrews, the Australian Assistant Minister for Vocational Education and Skills, has announced a national Electronic USI  Transcript Service for VET students. This will allow students to obtain an electronic copy of what they did from 2015, onwards. However, the purpose and status of the service is unclear.

The USI website says "The online transcript will have many uses ...", but does not say what all those uses are. It says "This transcript will be a useful backup for when the original documentation is lost ...", but also says "... it does not replace the qualifications or documentation issued by training organisations ...". These statements are contradictory: to be a backup the new service must be able to replace the documentation previously issued.

I suggest the Government needs to decide if the USI Transcript Service can be relied on, or not. If the information in the government's database can't be relied on, then there seems to be little point in having the system. If it can be relied on, then it should be used in place of paper based certificates, which are easily forged.

Visible Learning: see learning through the eyes of students

John Hattie (2015) argues that most teaching techniques work, but what works best is "visible learning": seeing learning from the students point of view, so they learn to learn. In this updated meta-meta-analysis it is easy to get lost ion the detail. But there are some useful, practical points for school and higher education teaching:

1. Minimal effects of class size: Reducing class size only makes a small improvement in student's learning (Hattie mentions classes of 600 to 15). It occurs to me that the cost of staff is a large part of the education budget, so the way to improve the quality of education may be to increase class sizes. The staff time saved can be devoted to helping students.
2. Student preparation is important: Flipped classrooms work where students actually do the preparatory work and are aware of what they have learned. As an example, I have students in my "ICT Sustainability Course" undertake a automated on-line quiz after each module.
3. Reviewing increases learning dramatically: Hattie finds that taking notes does not help learning much, but reviewing the notes does. Also students learn from each other. As an example, I have my ICT Sustainability students answer two or three questions after each module, discuss it and them peer assess each other's contribution.
4. Problem Based Learning (PBL) later: Hattie suggests that PBL has not been show to be effective as it has been used for first-year students who do not yet have the basic knowledge required. They argue this will be more effective for later years. In my teaching of students in the ANU TechLauncher program, this seems to be the case. Teams of third year and graduate computing and engineering students work on real projects for real clients.
5. E-learning is just as effective as a classroom: Hattie points out that online and distance courses are just as effective as on campus learning. This has been well established in the research as the so called "No Significant Difference Phenomenon". However, many academics find it difficult to accept that their live lectures make no difference to student learning: live video, recorded video and no video at all is just as effective.
6. Training university academics to teach: Hattie argues that training university academics to be effective teachers improves student learning. This may seem obvious, but university academics still resist the idea that they need to be trained to actually teach. Particularly at research orientated universities the emphasis is on academics conducting research on teaching, but not undertaking the type of basic learning of teaching techniques which school and vocational college teachers are required to undertake as a condition of employment.
7. Alignment of Assessment and Course Aims: Hattie points out that students use the assessment as a guide to what is important in a course. As a recent graduate student myself, I found this very much the case. It was frustrating when the instructor had us study what was not assessed, then assessed us on something only briefly touched on in the course.
   
   There seems to be an article of faith amongst some in academia that students should not be driven by assessment and marks. Curiously, when it comes to rewards in the form of research grants and promotions, these same academics are very much directly driven by short term concrete rewards, not the esoteric pursuit of knowledge. ;-)
   
   In my own course design, I am careful to show the students the explicit link from the skills demanded by industry, the course learning objectives derived from those skills and the assessment items supporting the learning outcomes. For each module of a course the student can see there is some assessment at the end, with a deadline.

The paper is an update of the earlier book. 

Visible Learning and the Science of How We Learn

John Hattie, Gregory C. R. Yates

 

Reference

Hattie, J. (2015). The applicability of Visible Learning to higher education. Scholarship of Teaching and Learning in Psychology, 1(1), 79. retrieved from http://psycnet.apa.org/doi/10.1037/stl0000021

Assessing STEM Students Using ePortfolios

The final assessment item for Computing and engineering students undertaking group projects in the TechLauncher Program at the Australian National University is a Personal Development Review (PDR). Last year this was a reflective portfolio prepared by the student using the Mahara e-Portfolio tool and worth 30% of the total course assessment. This year the exercise has been halved to 15% and recast as an a job application (1,000 to 1,250 words) against five selection criteria:

Dr Shayne Flint and

Dr Chris Browne

1. "demonstrated proficiency in a technical area of expertise
2. a positive attitude and/or clear organisation skills
3. teamwork and/or leadership
4. demonstrated service to the workplace
5. a commitment to personal development"

From: TechLauncher Personal Development Review, Shayne Flint and Chris Browne, ANU College of Engineering & Computer Science, 2017

Students will be assessed against these criteria. The use of Mahara is no longer suggested, with the student simply submitting a word processing document via the Moodle Learning Management System.

As I discovered myself, having to complete a reflective portfolio last year for a MEd, this is a particularly difficult task for a STEM student. Having been trained to always emphasize hard facts and write in the third person, it is difficult to suddenly write about myself and my personal relationship to the work. Treating the task like a job application should provide more focus for the students. However, this is still difficult where students have been undertaking teamwork and trained to be "team players" but then asked to write about what they, individually, accomplished.

Peace Through Superior Innovation

Greetings from the Canberra Innovation Network (CBRIN) office, where I am attending a ACT Defence Industry Forum. Former Senator for the ACT, Kate Lundy, the ACT Defence Industry Advocate opened the event. She pointed out that while defence industry in South Australia is discussed in the media, Canberra is the location of the ADF headquarters and many supplier companies. This is timely as I was on a panel for ANU software engineering students this morning, including a discussion of cyber-security and  radar design for warships (which is done in Canberra).

The choice of CBRIN for this event is interesting, as it is usually associated with web startups for consumer products, which would seem a long way from military systems. However, supporting the heavy iron military equipment are thousands of products and services provided by small specialist companies. I saw this first hand in 1997 when taking part in a multi-nation military exercise in Queensland. Not only were there companies at the temporary base set up for the operation, but deployed on warships at sea. I flew out into the Coral Sea by military helicopter to meet with my colleagues on the US fleet flagship, where I bumped into many civilians supporting the military.

Petr Adámek, the new CEO of CBRIN challenged the defence industry to think about how innovation could be better done. One way I suggest is to look at adopting some of the gig-economy techniques to defence services. This does not need to involve guns and bombs. Most defence spending goes on personnel: training people, feeding them, and keeping them healthy. The military also spend a lot on "logistics": getting materials needed to the right place at the right time.

A current example is the ADF restructuring to its traditional role as an amphibious fighting force. Australia has invested several billion dollars in amphibious warfare ships, which can transport personnel and equipment across the region onto a shore. However, retraining the Army to be effective marines, to get all the supplies they will need to where the ship is and all of the support on board is an opportunity for many new products and services.

One Course at a Time Makes Study Easier

In "Sequential single-unit blocks pave the pathway to academic success", Peter Dawkins and Ian Solomonides describe an approach being used for Victoria University first-year students (The Australian, 10 May 2017). With this students undertake four week modules, one at a time. This is an approach common in the vocational education and training sector, but contrasts with the usual university format of four 12 week courses simultaneously.

This so-called sequential approach is useful not just for beginning undergraduates, but also more experienced part-time students. The Australian Computer Society used this approach with its on-line Computer Professional Education Program, which I helped teach. These were full 12 week courses, with four required to complete the program. Students could take several at once, but were encouraged not to.

I used this sequential approach for my own postgraduate studies. In undertaking a graduate certificate and then masters I found it difficult to cope with more than one course at a time. The exception being the Masters capstone project undertaken simultaneously with my last course.

Unfortunately some Australian universities still have only two "semesters" a year making this approach unmanageable, while many have three terms. Ideally universities would have four terms per year. Students (and staff) would have the option not to studying (or teaching) every term, but those in a hurry could. I found it manageable to be a student doing three or four courses a year for five years.

Framework for Open Learning Funding Cut

One small item in the Australian Budget 2017-18 was a $2.5M cut in funding for the Framework for Open Learning (FOLP). ICT for schools, VET and higher education to provide open learning is a worthwhile objective and one which could save billions of dollars.

"The Government will achieve efficiencies of $2.5 million over four years from 2017-18 by returning uncommitted funding for the Framework for Open Learning Program to the Budget. Projects currently funded under the Program will continue until their completion. Ongoing funding of $0.5 million per annum will remain from 2021-22 to continue to support schools to help connect and exchange data digitally.

The savings from this measure will be redirected by the Government to fund policy priorities."

From "Budget Measures, Budget Paper No. 2 2017-18", page 81, 2017

Future of Teaching and learning at ANU

New ANU Buildings
(artists' impression).

Greetings from the Australian National University (ANU) in Canberra where Professor Marnie Hughes-Warrington is speaking on the Teaching and learning futures at ANU. This is one of a series of talks about the new Union Court Development. There are also Union Court podcasts. Three of the new buildings will include teaching facilities. There will be a student services building, teaching and cultural events building (with large theaters).

The teaching building will have 60% formal learning spaces and 40% informal. Rooms are designed for 30, 60, 90 and 120 students (some rooms have movable walls). There will be translucent glass panels to provide privacy with light. The top floor will have a "super-floor" suitable for 320 students in cabaret style.

For the last ten years I have been looking at suitable teaching space design and for three years learning about teaching styles to suit these spaces. I will be presenting on this in "Dogfooding: Learning About Teaching by Being an On-line Student", at ANU, 1pm, 15 May 2017.

The culture and event building will have a flexible space with movable 200 and 512 seat tiered lecture theaters. This is intended to be used for sports and examinations with the seating retracted. I have been to conferences in similar spaces in Hong Kong and Cambridge. There will also be 150 and 300 fixed seat theaters for performances and lectures.

While the new buildings are being built there will be a need for temporary facilities. I have suggested rather than finding large temporary lecture theaters instead change to flipped teaching in flat floor rooms. Apart from being easier to find flat floor spaces this will improve the teaching.

One interesting aspect is that Professor Hughes-Warrington pointed out the new teaching building will be constructed from cross-laminated timber rather than concrete and steel. She suggested this will improve the WiFi signals, but I suspect the cabling in the building will still limit transmission.

"The university landscape is rapidly transforming, driven by societal and technological change on a global and local level. These changes provide us with an opportunity to ensure that we are providing an enriched and valuable learning experience here at ANU.

The revitalised Union Court precinct ANU is building will feature some of the country’s most advanced collaborative learning environments.

This forum will discuss the opportunities these spaces provide for teaching at ANU and the wide range of teaching possibilities our spaces will accommodate, including didactic lectures, tutorials, seminars, flipped classrooms and more."

Making University Relevant to Entrepreneurs

Universities need to counter the "universities kill innovation" view in the entrepreneurial community. This was evident in Steve Baxter's talk at River City Labs in Brisbane last Friday.

On Friday I had some free time in Brisbane so I went along to River City Labs Entrepreneur's Story Evening. River City Labs is a coworking space, much like Fishburners in Sydney and Entry 29 in Canberra. Those wanting to start a new tech business get some office space and help.

River City Labs is in the historic TCB Building  at Level 3, 315 Brunswick Street Fortitude Valley. They recently moved from around the corner in Wickham Street (some events in Eventbrite still have the old address). Like many start-up spaces, River City Labs seems to delight in being hard to find. You go down an almost deserted shopping arcade and turn left into a passageway which apparently ends with a blank brick wall. Closer examination shows this is a lift lobby, with the lift doors disguised in brick pattern wallpaper (why?). The only way I found the place was people coming out wearing jeans, black shirts and carrying laptops (the Steve Jobs looks). ;-)

Once inside, River City Labs is a world-within-a-world. This multistory space is fitted out in the usual New York Loft warehouse style of co-working spaces: bare wooden floorboards, bare brick-walls and services visible on the ceiling. There is glass partitioning, making the most of the light from the clerestory windows of the large atrium.

Steve Baxter, as it turns out is not only one of the founders of River City Labs but also appears on the  Australian TV series Shark Tank. Steve is originally from Brisbane, made his mark as an ISP pioneer in Adelaide, then in the USA before returning to Brisbane.

Steve made several comments about the role of universities in innovation, both in his talk and in answering questions after. What he seemed to be saying was that successful tech startups are founded by technologically competent entrepreneurs, not business people. Steve suggested that the tech entrepreneur could obtain business advice and training, but a business person without the needed tech training would have more difficulty.

Steve seemed keen for school leavers to undertake tech degrees at university, but otherwise did not want universities involved in innovation. It was not clear to me what he thought universities were doing that they shouldn't do. Apart from educating students, universities conduct fundamental and, some applied, research. My preferred approach for university research to be exploited is the Cambridge Phenomenon Model: some of the graduates involved with the research transition to the private sector to commercially exploit the work, with the institution perhaps retaining a financial interest. The hands off approach where the scientist hands their work to a company to develop does not work well: the scientist has to get their hands dirty working in industry.

After Steve's anti-university comments I got a laugh asking the last question, when I mentioned I was associated with ANU (I happened to be wearing a black t-shirt with "ANU" in very large white letters). I pointed out that some tech students in Canberra are encouraged to go to the Canberra Innovation Network (equivalent to River City Labs) to learn about entrepreneurship, they then receive credit for the project work they do. Programs such as ANU Techlauncher try to balance the academic and practical aspects. Steve seemed to like this idea.

If entrepreneurs have the idea that universities just turn out academics of no value to industry, then this will become a self fulfilling prophecy. I don't agree with Steve that universities should just produce tech graduates. The universities can also teach tech graduates some basic business skills: how to make a presentation, plan a project, work about cost and what the client wants. Also universities can provide sub-degree and shorter post-degree education to help entrepreneurs. It doesn't have to be a school-university-job production like of people.

Train Teachers to be Professional

In "Here’s what is wrong with testing teachers and Teach For Australia" Keith Heggart (1 May 2017) discusses and dismisses both raising the ATAR and using ah-hoc teacher programs. However, Heggart does not offer a viable alternative. I suggest training teachers to be proactive professionals, who take responsibility for how to teach.

Teach for Australia encourages graduates, particularly in STEM, to take up teaching. This has a high profile currently, being the subject of a SBS TV documentary "Testing Teachers". It is good to see there are some idealistic individuals willing to sacrifice a high paying career to go into teaching. This makes good TV, but clearly is not a viable public policy. If you want highly qualified teachers, then you have to train and pay them all accordingly.

For similar reasons, I suggest that raising ATARs will not improve teaching quality on its own. Why would a university student choose a teaching degree, if they can select an alternative leading to higher pay, less stress and shorter working hours?

Heggart proposes reducing teacher workloads, but does not provide a strategy for doing this. If teachers are willing to work long hours for little pay, why would governments and employers be motivated to change that situation? I suggest that the teachers themselves need to be trained to change this.

Teachers can be trained to be true professionals, who make decisions about what and how they teach. One part of this would be for teachers to cooperate to design the way they teach so it makes efficient use of their time and that of the students.

Rather than just responding to demands on their time and spending long hours filling out useless paperwork, teachers could be trained to prioritize their time. Teachers could work out what is important for their student's learning and allocate time to those tasks. What is not important for learning and for which there is no time should simply not be done.

The issue of how to teach is now being debated at universities. ANU is demolishing its central lecture theater facilities. I have suggested we take the opportunity to do our teaching differently. Lectures are not a particularly useful way to teach university students and so I have suggested we stop doing it.

School teachers can be trained to design learning to efficiently use available resources. The scarcest of those resources are teacher and student time. Teachers can be trained to use technology to reduce administrative burdens and also to collaborate with their peers. Rather than a teacher alone in a classroom, being told to fill out a whole lot of forms, they can focus on actually teaching.

This is not to suggest some sort of revolutionary takeover of schools by teachers. Instead it is suggesting teachers be trained to take responsibility for teaching. Trainee teachers can then have support from mentors and peers on-line. As they advance through their careers teachers can include the role of planning and implementing the future of education as part of the work of a professional.