AN ANALYSIS OF THE CURRICULUM COMPONENTS OF COMPUTER FORENSICS UNDERGRADUATE COURSES IN THE UNITED KINGDOM

Transcription

1 AN ANALYSIS OF THE CURRICULUM COMPONENTS OF COMPUTER FORENSICS UNDERGRADUATE COURSES IN THE UNITED KINGDOM Paula Thomas Faculty of Advanced Technology, University of Glamorgan 2 CF37 1DL, Pontypridd pthomas@glam.ac.uk Theo Tryfonas Faculty of Engineering, University of Bristol, BS8 1TR, Clifton t.tryfonas@bristol.ac.uk Iain Sutherland Faculty of Advanced Technology, University of Glamorgan 2 CF37 1DL, Pontypridd isutherl@glam.ac.uk ABSTRACT A typical undergraduate curriculum of study in Computing contains a broad range of modules. Computer Forensics is a specialised area of Computing and if specialised modules are being introduced into a typical Computing subject curriculum then one or more of the more traditional subject modules must be removed or modified to provide space to accommodate the new material. This paper investigates the opinions of academic members of staff from several UK institutions on which Computing subject areas should be included in specialised curricula in Computer Forensics. It builds on work done during the third Annual HE Academy Workshop on Teaching Computer Forensics, where delegates were asked to contribute to an undergraduate curriculum design exercise. The delegates were mostly academic lecturing staff from HE institutions around the UK and they were primarily involved in the delivery of Computer Forensic courses at undergraduate and postgraduate levels. They were asked to design an undergraduate BSc (Hons) course in the subject area of Computer Forensics by selecting six modules for each level of a three year undergraduate BSc (Hons) course. There were no constraints on module selection apart from having to select six modules at each level from a list of module titles based on current modules used in UK universities. The paper summarises the results and comments upon principles of design for curricula in this particular subject area. Keywords Computer forensics, Curriculum design. 1. INTRODUCTION A typical undergraduate curriculum of study in Computing contains a broad range of modules relating to Information Technology themes. The curriculum is designed to equip the student with the necessary practical skills for a career in the industry. A curriculum will therefore comprise a range of modules that deliver the knowledge and skills relating to the mainstream computing themes (e.g. software engineering, network administration) that the student is expected to acquire as part of a course of undergraduate study in Computing. The ACM guidelines for curricula at educational institutions provides recommendations for Information Security education but does not specify the topics, modules, or course structure. As a consequence, there are numerous computer security education models and curricula in existence. [1] The curriculum programme will typically contain six modules at each of the three levels of the course of undergraduate study. Most undergraduate curricula in Computing have similar underlying themes that are studied at each levels of the course. These underlying themes can be broadly identified as programming, databases, networking, internet technologies and personal skills. The specific curriculum can vary in that differing emphasis is placed on the underlying themes, for example one undergraduate course may concentrate on programming skills whereas another course may put more emphasis on networking techniques. In the subject area of Computer Forensics Gottschalk et al identified such a curriculum as being multidisciplinary including legal issues, ethics, information technology and computer science [2]. Bacon also introduced a similar curriculum with a strong general computing element [3]. However, as Computer Forensics is a specialised subject area, it was expected that a computer forensics curriculum would include a number of modules with specific content, offered at the different levels of undergraduate study. This though would introduce a challenge to the design if specialised modules were introduced to a typical Computing curriculum, then this is going to become overloaded. The solution is usually to exclude one or more of the more traditional subject modules. 39

2 The aim of this paper is to identify which Computing themes and/or subject modules are deemed by academics as appropriate to be omitted, in order to offer a more specialised curriculum in the area of Computer Forensics. The paper in turn is structured as follows: section two describes our workshop-based data collection approach, section three presents the results, section four discusses our observations, and we conclude in section five. 2. RESEARCH METHODOLOGY In order to gather the necessary information, all the undergraduate courses in Computer Forensics or Forensic Computing needed to be identified and their composition noted. Identifying the courses was facilitated by the University Central Administration System (UCAS) [4] and the wide range of websites and books that detail undergraduate courses. Each course was analysed in order to identify the curriculum content at each level of the course. Most of the courses have their own web pages on their University website which gave the main course detail. However, the curriculum content detail varied considerably from detailed module content to just an overall course outline. This makes it difficult for a prospective student to accurately compare course content between the programmes of study offered by different universities. Also, it was found that some of the module titles for a specific topic varied greatly but were essentially covering the same topic details. For example, the names of the specialised modules in computer forensics were called Computer Forensics, Forensic Computing, Computer Crime & Digital Evidence, and Forensic Computing and Security. 2.1 Selected Sample s Characteristics A total of 17 undergraduate courses were identified in the subject area of Computer Forensics. These courses were all full time, three year, Bachelor of Science Honours courses with the titles of Computer Forensics, Forensic Computing or Digital Forensics. The majority of the courses required a prospective student to gain 240 UCAS points on entry and most of the courses were offered with a third year industrial placement option. There were other courses offered in the subject area for students with lower entry qualifications who could study for an Ordinary Degree, Foundation Degree or HND. However, as the curriculum component of these courses appeared to be a subset of the full Honours Degree courses, then these courses were omitted from the study. 2.2 Curriculum Design Exercise The delegates at the 3rd Annual HE Academy Workshop on Teaching of Computer Forensics were asked to contribute to an undergraduate Computer Forensic curriculum design exercise. The delegates were mostly academic lecturing staff from HE institutions around the UK and they were primarily involved in the delivery of Computer Forensic courses at undergraduate and postgraduate levels. The delegates were asked to design an undergraduate BSc (Hons) course in the subject area of Computer Forensics. They were asked to select a course title and modules to be studied at each level of the course. They were given a series of tables that listed the module titles that may be selected at each level of the course. These module titles were all currently offered on existing BSc courses in the subject area. The delegates were asked to select six modules from each level that they considered to be the most appropriate for such a course. There were no constraints on module selection apart from having to select six modules at each level. The delegates were not given any information about the modules other than the module title. They were also asked to state their expectations in terms of the module content. This exercise was deliberately planned in this way to demonstrate how the selection process is made more difficult with little information. A potential student looking for a course of study will only be given module titles and on occasion even this information is not made available on some university websites. 3. CURRICULUM DESIGN EXERCISE RESULTS 3.1 Course Title and Brand Identity The course titles that were detailed had been collated from those listed by University Central Administration System (UCAS) [4]. There was quite a wide and varied range of course titles on offer. The table below gives the course titles that were given to the delegates for selection and the title that they each selected as their preferred course title. Proposed Course Title Number Chosen as preferred 40

3 title Computer Security & Forensics 4 Digital Forensics 4 Computer Forensics 3 Computer Forensics & Security 3 Forensic Computing 3 Cyber Security & Computer Forensics 1 Digital Investigation 1 Secure & Forensic Computing 0 Ethical Hacking & Countermeasures 0 Table 1 Course title Selection As expected, the most popular course titles all contained the word Forensics in the title. The delegates commented that the course title is very important for marketing purposes and an interesting, eye catching course title was vital to the success of a course. It is interesting that Computer Forensics, Digital Forensics and Forensic Computing are all viewed as comparable course titles. The term forensic computing has been associated with the use of computers to support traditional forensic investigation, and the term digital forensics has been suggested as a more appropriate term to encompass the analysis of other digital devices [5]. Although exact definitions are still an area for debate as the terms are used interchangeably and in the current literature there are a number of related definitions as discussed in Hannan [6] and McKemmish [7]. These subtle differences are lost on the prospective student. 3.2 Module Selection and Programme Structure The modules from all the course titles on offer were collated and were then grouped by level, Level 1 being first year undergraduate etc. and were detailed on a table. The range of modules was broad and encompassed most general computing topics. The module titles were varied with little information as to the actual module content. Most University websites and prospectuses give limited detail on course content and often only give a broad outline of the topics to be studied at each level of the course. The resultant table contained a significant number of modules at each level with Level 1 having 46 modules, Level 2 having 59 modules and Level 3 having 34 modules. No modules were omitted, however, there were some modules that would appear to have similar content but differing titles, for example at Level 1 there were modules entitled Computer Forensics & Security and Forensic Computing & Security. As there was no detailed module content, it was difficult to distinguish between them. This is an issue that UCAS applicants face, as a potential student has to select a course based on the limited information given on the University website or the prospectus. Obviously more information can be obtained about a course by attending a University Open day but this may not be an option at the time of course selection. Therefore, each workshop delegate was asked to design the curriculum for their undergraduate BSc (Hons) course in the subject area of Computer Forensics based on a limited amount of information, i.e. a list of 41

4 course titles and the tables of modules at each level reflecting the information available to a potential student. The workshop delegates were asked to select six modules from each level of the course that they felt were the most appropriate for a course. There were no constraints on module selection apart from having to select six modules. There were a significant number of modules for consideration at each level, for example, the module table for Level 1 contained a total of 46 module titles. The results detailed in Table 2 show the overall module selections of the 23 workshop delegates grouped into the themes discussed above. Specialist Forensic modules were selected for Level 1 of the course by all but two delegates. The specialist computer forensics modules were selected by every delegate at Levels 2 with some delegates selecting more than one module from this theme at Level 2. As expected all delegates selected at least one specialised computer forensics module for Level 3 of the course. In terms of other subject areas, there is a strong Networking theme at all levels with it being selected at more than one level of the hypothetical course under development. Personal Skills modules were consistently selected across all levels, however, this type of module tended to only be selected once by a delegate for inclusion at one level of the course. The Programming theme was strongly favoured at Level 1 but its selection diminished significantly at Level 2 and disappeared at Level 3. At Level 3, the modules selected tended to be almost solely concerned with the themes of specialised Forensic and Networking and other modules that appeared to be concerned with Legal and Ethical issues. Every delegate selected a double project module at Level Themes Selected by Workshop Delegates Programming Databases Networks Personal Skills Specialist Forensic 0 Level 1 Level 2 Level 3 Table 2 Themes Selected by Workshop Delegates 4. ANALYSIS OF RESULTS AND DISCUSSION Comparing the results given in Table 2 for the workshop delegates and Table 3 for current courses, it can be seen that 20% of the current courses do not include a specialised Computer Forensics module or a Networking module at Level 1. The theme that was least selected at Level 1 by the workshop delegates was Databases, however, this theme features quite strongly in the current courses. The current course curricula appear to have quite a consistent content across all the themes. This is due to specialised Computer Forensic courses evolving from existing computing curriculum where Level 1 is used to give fundamental skills in general computing topics. Given the freedom to design a specialised course with no constraints, then the general computing topics are omitted in favour of more specialised content. Analysis of the current courses seems to suggest that at Level 1 much traditional computing content has been retained with Personal Skills being the theme that is omitted to make space in the curriculum for the Computer Forensic modules. Petrova et al [8] discussed incorporating computer security modules into an existing curriculum where there were no Personal Skills modules. These modules, they argued, should be studied prior to the commencement of the undergraduate award. Also, Bogolea & Wijekumar [9] defined a significantly technical computer security content in their survey of undergraduate awards in the USA. 42

5 Themes of Current Courses Level 1 Level 2 Level 3 Programming Databases Netw orks Personal Skills Specialist Forensic Table 3: Themes of current courses Our exercise participants had a different opinion and largely omitted the Database theme from the Level 1 curriculum. At Level 2, the differences become more apparent. The current courses appear to have omitted the Personal skills theme at this level in order to include the specialised Computer Forensic modules. The other Computing themes remain consistent in the curriculum at much the same rate as in Level 1. The workshop delegates selected more specialised modules at Level 2 and significantly reduced the inclusion of the Programming and the Database themes. The Networking theme remains strong, as does the Personal Skills theme. Further at Level 2, the difference between the two tables is quite marked. Every workshop delegate selected several Computer Forensic modules for this level of their course, whereas more than 10% of the current courses did not include such a specialised module at Level 2. The Programming theme was only selected by 25% of workshop delegates whereas nearly 90% of the existing courses include Programming modules at this level. Networking and Database modules still feature very strongly in the curriculum of the current courses which leaves little opportunity to include any specialised modules. Only a quarter of current courses include modules from the Personal skills theme while over half of workshop delegates included a Personal Skills module at this level. It is at Level 3 that the workshop delegates were really able to focus on the main theme of the course and excluded the main computing themes of Programming and Databases in favour of increased modules in Computer Forensics. There is a significant difference between the modules at Level 3 (i.e. final year), selected by the workshop delegates and those currently being offered on existing courses as shown in Tables 2 and 3. The workshop delegates did not select any Programming or Database modules to be included at this level of the course whereas 30% of current courses include these themes. Each workshop delegate selected two or more specialised Computer Forensic modules for inclusion. The Personal Skills theme remains strong with over 50% of the workshop delegates selecting module titles concerned with ethical and legal issues. 5. CONCLUSIONS The experiment discussed in this paper was an academic exercise conducted as part of a Higher Academy Workshop on the Teaching of Computer Forensics. The workshop delegates were all experienced academics with varying levels of expertise in the area of Computer Forensics. This exercise has demonstrated that the current BSc (Hons) courses in Computer Forensics retain much curriculum content that relates to general computing topics and possibly reflects the uncertainty during a phase of identity shaping of the professional field of practice itself. The development of these specialised courses has resulted in a trade off between the inclusion of a Computer Forensics theme and the selection of which traditional computing theme to omit. Overall, it can be seen that the workshop delegates designed a curriculum that contained modules from themes that were considered more relevant to the specialised area of Computer Forensics. The specialised content was higher than in the current courses with more specialised modules being included at Levels 1 and 2. Most current courses only offer one specialised module at Level 1 and 2, whereas the workshop delegates were including at least one module at Level 1 and two or more modules at Level 2. At Level 3, there were usually three specialised modules both on the current courses and the designed curriculum by the workshop delegates. In the current course curriculum, it appears to be the general Personal Skills theme that has been largely omitted in order to include another specialised theme. The Personal Skills modules that have been included tend to have specialised content that is particularly relevant to the new theme. 43

6 In practice, it is almost impossible to design a new undergraduate, specialised course free from any form of constraints. There are usually University curriculum requirements to adhere to that require the inclusion of certain themes, for example Personal Skills. There may be a common Level 1 curriculum across a subject range which will restrict the inclusion of a specialised module. Also the accreditation standards of the British Computer Society, and other awarding bodies, will need to be considered and maintained. Resource and staff development issues will also be a concern when introducing a new, specialised subject area. However, if the momentum towards more specialised undergraduate Computing courses is to be maintained then the curriculum design process has to be more flexible. There will always be a need to include some of the traditional Computing themes, however, the curriculum emphasis will need to change in favour of the modules that are particularly relevant to the specialised award. 6. REFERENCES [1] ACM Curricula Recommendations, [2] Gottschalk L., Liu J., Dathan B., Fitzgerald S. & Stein M., Computer forensics programs in higher education: a preliminary study, ACM SIGCSE Bulletin, 37(1), (2005). [3] Bacon T., & Tikekar R., Experiences with developing a computer security information assurance curriculum, Journal of Computing Sciences in Colleges, 18(4), (2004). [4] [5] [6] Hannan M., To Revisit: What is Forensic Computing In Second Australian Computer Network and Information Conference (2004). [7] McKemmish R., What is Forensic Computing? Trends and Issues in Crime and Criminal Justice 118 (1999). [8] Petrova K., Philpott A., Kaskenpalo P. & Buchan J., Embedding information security curricula in existing programmes In: Proceedings of the 1st annual conference on Information security curriculum development, Georgia, USA (2004). [9] Bogolea B. & Wijekumar K., Information security curriculum creation: a case study In: Proceedings of the 1st annual conference on Information security curriculum development, Georgia, USA (2004). 44