@inproceedings{JahnKaulMottok, author = {Jahn, Sabrina and Kaul, Nicolas and Mottok, J{\"u}rgen}, title = {Using or Misusing? Introducing Misuse Cases in a Software Engineering Course for Undergraduate Engineering Students}, series = {ITiCSE '22 : Proceedings of the 27th ACM Conference on on Innovation and Technology in Computer Science Education, Vol 1: July 8 - 13, 2022, Dublin Ireland}, booktitle = {ITiCSE '22 : Proceedings of the 27th ACM Conference on on Innovation and Technology in Computer Science Education, Vol 1: July 8 - 13, 2022, Dublin Ireland}, publisher = {Association for Computing Machinery}, address = {New York, NY}, doi = {10.1145/3502718.3524823}, pages = {491 -- 497}, abstract = {Today's cyberphysical systems are increasingly prone to misuse. To secure existing and future software systems, introducing concepts of IT-Security and Secure Software Engineering (SecSE) in Software Engineering (SE) courses is essential for academic education of future software engineers. This is not only important for computer science students, but also for engineering students studying topics of computing and SE. However, only little research exists on integrating these topics into traditional SE courses, especially for engineering students in non-computer science majors. To narrow this gap, this paper contributes with the design and evaluation of an exercise on modeling misuse cases alongside use cases, based on the inductive teaching method problem-based learning (PBL). The exercise is part of an educational design research investigating which learning content and teaching methods are suitable for integrating IT-Security and SecSE topics into traditional SE education of engineering students to convey factual knowledge as well as raise awareness and interest for both topics during software development. We present the integration of the exercise design into a traditional SE course for engineering students and its evaluation to examine its suitability. We evaluated the exercise design regarding the suitability of the design components, the learning content of misuse cases and the intended learning goals as well as its impact on students' motivation, and their interest in IT-security. The paper then presents indications on the feasibility and success of the exercise design for teaching misuse cases to engineering students and sparking their interest in IT-Security.}, language = {en} } @inproceedings{JahnMottok, author = {Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Work in Progress: Towards an Academic Secure Software Engineering Curriculum for Engineers}, series = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, booktitle = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, doi = {10.1109/EDUCON45650.2020.9125210}, pages = {1713 -- 1717}, abstract = {In the age of the Internet of Things, it is becoming increasingly important to integrate knowledge about the development of secure systems (Secure Software Engineering) into academic teaching. However, teaching IT Security and Secure Software Engineering to non-computer scientists is rare. Therefore, we focus our research on the integration of IT Security into software engineering education of non-computer scientists, particularly electrical engineers, by means of inductive teaching- and learning-arrangements. After collecting students' preconceptions of IT Security and Secure Software Engineering in prior work, this paper now contributes with a first mapping of these preconceptions with corresponding learning content as well as suitable inductive teaching methods to be able to create new lecture and exercise units and improve academic learning and teaching in both areas.}, language = {en} } @inproceedings{ReuterJahnFigasetal., author = {Reuter, Rebecca and Jahn, Sabrina and Figas, Paula and Bartel, Alexander and Mottok, J{\"u}rgen and Hagel, Georg}, title = {Learning Tasks for Software Engineering Education: An exemplary development of learning tasks for software engineering based on didactic function and knowledge type}, series = {Proceedings of the 3rd European Conference of Software Engineering Education (ECSEE'18), JUne 2018, Seeon, Bavaria, Germany}, booktitle = {Proceedings of the 3rd European Conference of Software Engineering Education (ECSEE'18), JUne 2018, Seeon, Bavaria, Germany}, doi = {10.1145/3209087.3209097}, pages = {1 -- 7}, abstract = {Learning tasks play an important role in education and especially in higher education. However, there is a significant lack in research regarding these in higher education. A learning task shows several characteristics, whereas the didactic function of a task is mostly considered. Two characteristics of learning tasks are focused in this paper: The didactic function and the type knowledge. Existing types of learning tasks are presented as well as a proposal for learning tasks in software engineering education that considers didactic functions, like elaboration, training or application and types of knowledge, i.e. factual, conceptual, procedural and metacognitive knowledge. This paper aims to serve as a guidance for lecturers who have the purpose to create learning tasks that address both characteristics -- the didactic function and the type of knowledge.}, language = {en} } @article{FuxenSchoenhaerlSchmidtetal., author = {Fuxen, Philipp and Sch{\"o}nh{\"a}rl, Stefan and Schmidt, Jonas and Gerstner, Mathias and Jahn, Sabrina and Graf, Julian and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {A Cybersecurity Education Platform for Automotive Penetration Testing}, series = {International Journal On Advances in Security}, volume = {15}, journal = {International Journal On Advances in Security}, number = {3\&4}, publisher = {IARIA}, issn = {1942-2636}, pages = {106 -- 118}, abstract = {The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education \& Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method.}, language = {en} } @inproceedings{HauserGrabingerMottoketal., author = {Hauser, Florian and Grabinger, Lisa and Mottok, J{\"u}rgen and Jahn, Sabrina and Nadimpalli, Vamsi Krishna}, title = {The Expert's View: Eye Movement Modeling Examples in Software Engineering Education}, series = {Proceedings of the 5th European Conference on Software Engineering Education, Seeon/Germany, June 19 - 21, 2023}, booktitle = {Proceedings of the 5th European Conference on Software Engineering Education, Seeon/Germany, June 19 - 21, 2023}, publisher = {ACM}, isbn = {978-1-4503-9956-2}, doi = {10.1145/3593663.3593683}, pages = {148 -- 152}, abstract = {This study investigates the impact of eye movement modeling examples in Software Engineering education. Software Engineering is a highly visual domain. The daily tasks of a software engineer (e.g., formulating requirements, creating UML diagrams, or conducting a code review) require in many cases the use of certain visual strategies. Although these strategies can be found for experts, it has been observed in different eye tracking studies that students have difficulties in learning and applying them. To familiarize students with these visual strategies and to provide them with a better understanding for the cognitive processes involved, a total of seven eye movement modeling examples was created. The seven eye movement modeling examples cover relevant parts of an introductory Software Engineering lecture; they are focused on typical situations in which visual strategies are applied. The results of a questionnaire-based evaluation shows that students consider the eye movement modeling examples as useful, feel supported in their learning process, and would like to see more use of them in the Software Engineering lecture. Furthermore, the students suggested that eye movement modeling examples should also be used in other lectures.}, language = {en} } @inproceedings{SeebauerJahnMottok, author = {Seebauer, Stefan and Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Learning from Escape Rooms? A Study Design Concept Measuring the Effect of a Cryptography Educational Escape Room}, series = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, booktitle = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, doi = {10.1109/EDUCON45650.2020.9125333}, pages = {1684 -- 1685}, abstract = {Experts predict that more IT-Security specialists will be needed in the coming years, but in current higher education in engineering disciplines, this topic is hardly addressed. Newer learning methods such as game-based learning (GBL) are enjoying an increasing popularity as their improvement in the education of subject specific topics can be proven by a variety of studies. We chose Educational Escape Rooms (EduER) as a GBL-tool to impart IT-Security in higher education of engineers. In our Escape Room (ER), the students try to solve puzzles and riddles with learned knowledge on the emphasis of cryptography. This paper first deals with a brief introduction to GBL and EduERs, followed by the design of our ER concept, containing different tasks with focus on the topic of cryptography. The tasks cover different cryptographic methods and hash algorithms, e.g. AES, RSA, SHA3. Afterwards the experimental study is presented. The study of the EduER was carried out with students from the bachelor's program in Electrical Engineering and Information Technology at the OTH Regensburg. The participants were divided into three groups of 5 to 8 persons each. They received a briefing with important information, followed by the ER execution, a debriefing afterwards and an exam-like evaluation sheet to test their learned knowledge. Finally, first basic results are presented.}, language = {en} } @inproceedings{KloppGoldVeerkampAbkeetal., author = {Klopp, Marco and Gold-Veerkamp, Carolin and Abke, J{\"o}rg and Borgeest, Kai and Reuter, Rebecca and Jahn, Sabrina and Mottok, J{\"u}rgen and Sedelmaier, Yvonne and Lehmann, Alexander and Landes, Dieter}, title = {Totally Different and yet so Alike: Three Concepts to Use Scrum in Higher Education}, series = {Proceedings of the 4th European Conference on Software Engineering Education (ECSEE '20): June 2020, Seeon/Bavaria, Germany}, booktitle = {Proceedings of the 4th European Conference on Software Engineering Education (ECSEE '20): June 2020, Seeon/Bavaria, Germany}, doi = {10.1145/3396802.3396817}, pages = {12 -- 21}, abstract = {Software process models are important in software projects in order to give the work of a project guidelines or a framework. However, teaching process models in higher education seems to be quite challenging. This has to do with the fact that undergraduates have no experience with projects in which process models are used. The theoretical mediation of process models is initially on a very abstract level. For this reason, we chose to combine two didactic approaches, namely problem-based learning and project work. Various traditional plan-driven process models have been expanded in courses in Software Engineering with agile process models. The Scrum Framework is the focus of consideration of this paper. Three Universities of Applied Sciences which cooperate in the EVELIN project focused on Scrum as a process model and integrated it into their teaching. Since the respective concepts of implementation differ, they should be presented and compared in this article to presents some practice approaches. The goal of this presentation of is a uniform evaluation in order to obtain insights from different perspectives. This comparison can draw conclusions for possible necessary improvements of the respective concepts.}, language = {en} } @inproceedings{JahnGoldVeerkampReuteretal., author = {Jahn, Sabrina and Gold-Veerkamp, Carolin and Reuter, Rebecca and Mottok, J{\"u}rgen and Abke, J{\"o}rg}, title = {Secure Software Engineering in academic education: students' sreconceptions of it security}, series = {12th International Conference of Education, Research and Innovation (ICERI2019), 11-13 November 2019, Seville, Spain}, booktitle = {12th International Conference of Education, Research and Innovation (ICERI2019), 11-13 November 2019, Seville, Spain}, doi = {10.21125/iceri.2019.1624}, pages = {6825 -- 6834}, language = {en} } @inproceedings{MuellerJahnReuteretal., author = {M{\"u}ller, L. and Jahn, Sabrina and Reuter, Rebecca and Mottok, J{\"u}rgen}, title = {A Task Design Concept For A Virtual Classroom For Requirements Engineering Education}, series = {ICERI 2018 Proceedings, Seville, Spain}, booktitle = {ICERI 2018 Proceedings, Seville, Spain}, editor = {Chova, L. G. and Mart{\´i}nez, A. L. and Torres, I. C.}, doi = {10.21125/iceri.2018.1216}, pages = {911 -- 920}, language = {en} } @inproceedings{SeebauerJahnMottok, author = {Seebauer, Stefan and Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Escape Rooms for teaching IT-Security}, series = {12th International Conference of Education, Research and Innovation (ICERI2019), 11-13 November 2019, Seville, Spain}, booktitle = {12th International Conference of Education, Research and Innovation (ICERI2019), 11-13 November 2019, Seville, Spain}, doi = {10.21125/iceri.2019.1623}, pages = {6815 -- 6824}, language = {en} } @inproceedings{SchreistetterHauserReuteretal., author = {Schreistetter, Stefan and Hauser, Florian and Reuter, Rebecca and Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Using Eye Tracking Data to analyze students' tasks solving behavior in classroom contexts}, series = {12th International Conference of Education, Research and Innovation (ICERI 2019), Conference Proceedings, 2019, Seville (Spain)}, booktitle = {12th International Conference of Education, Research and Innovation (ICERI 2019), Conference Proceedings, 2019, Seville (Spain)}, isbn = {978-84-09-14755-7}, issn = {2340-1095}, doi = {10.21125/iceri.2019.1473}, pages = {6087 -- 6096}, language = {en} } @inproceedings{JahnWeissAkcakocaetal., author = {Jahn, Sabrina and Weiss, Nils and Akcakoca, Ugur and Mottok, J{\"u}rgen}, title = {Under The Hood - A Concept for Virtualized Automotive Security Education}, series = {EDULEARN21: Proceedings}, booktitle = {EDULEARN21: Proceedings}, editor = {G{\´o}mez Chova, L. and L{\´o}pez Mart{\´i}nez, A. and Candel Torres, I.}, isbn = {978-84-09-31267-2}, issn = {2340-1117}, doi = {10.21125/edulearn.2021.1231}, pages = {6109 -- 6118}, abstract = {In recent years, our society faced a massive interconnection of computer-based everyday objects, which opens these items for cyber-attacks. Dependent on the physical capabilities, successful attacks can vary from data exposure or a loss of functionality to a threat to life and limb. Connected- and autonomous vehicles are extremely safety-critical systems with a huge damage potential. This global trend, together with existing and upcoming regulations (ISO 270xx, ISO 21434, UNECE WP.29, UNECE R155), and the lack of qualified professionals create a tension field for the entire automotive industry. Hence, new education concepts for engineers of safety-critical and connected systems are necessary to secure our daily and future systems against cyber-attacks and raise awareness and knowledge of the topic of IT-Security. Existing automotive security education systems have one common problem: All systems are hardware-based and therefore have very steep learning curves for beginners. Hardware-based systems, in general, are expensive in their initial costs, require regular maintenance, and add diverse operational difficulties independent of the aspired education goal. Additionally, the global pandemic increased the necessity of virtual education concepts for security training in cyber-physical systems. Therefore, we present a novel concept for the education of cyber-security professionals for automotive systems based on discovery and problem-based learning in a virtual learning environment (VLE). Our concept contains individual exercises focusing on the topics of vulnerabilities and attacks in automotive networks and systems. Each exercise relates those topics to the corresponding security goals and countermeasures for mitigation. The learners work collaboratively in a self-contained manner within the VLE to acquire the necessary information to answer questions or find a solution to the given problem. To consider the heterogeneous background (e.g. knowledge, experience, preconceptions) of the learners, the topics can be presented in different difficulties, enabling an adaptable learning environment and different learning trajectories within the exercises. The concept is based on a VLE, consisting of automotive networks and components, which simulate the behavior of a vehicle. This environment provides a hands-on, "real-life" scenario, which allows discovery and problem-based learning in a realistic, but cheap and scalable education environment. Furthermore, virtualization removes common difficulties, always present in training on real hardware. This aims to decrease complexity, prevent learning obstacles related to hardware handling, and enables a location-independent learning environment. The target group of our education concept is Bachelor and Master students of computer science, engineering (e.g. electrical engineering, mechatronics), or similar studies, and (experienced) engineers from the industry. In summary, our publication contains two contributions. We present an adaptable virtual learning environment for automotive security education, combined with an educational concept based on discovery and problem-based learning techniques. The goals of our concept are the education of cyber-security professionals for safety-critical, connected automotive systems and the support of life-long learning reaching from academic education to training in the industry.}, language = {en} }