TY - JOUR A1 - Fuxen, Philipp A1 - Schönhärl, Stefan A1 - Schmidt, Jonas A1 - Gerstner, Mathias A1 - Jahn, Sabrina A1 - Graf, Julian A1 - Hackenberg, Rudolf A1 - Mottok, Jürgen T1 - A Cybersecurity Education Platform for Automotive Penetration Testing JF - International Journal On Advances in Security N2 - The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education & Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method. KW - Challenge-based Learning KW - Education Framework KW - Penetration Testing KW - Automotive KW - IT-Security Education Y1 - 2022 UR - http://www.iariajournals.org/security/sec_v15_n34_2022_paged.pdf SN - 1942-2636 VL - 15 IS - 3&4 SP - 106 EP - 118 PB - IARIA ER - TY - CHAP A1 - Schönhärl, Stefan A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Schmidt, Jonas A1 - Hackenberg, Rudolf A1 - Mottok, Jürgen T1 - An Automotive Penetration Testing Framework for IT-Security Education T2 - Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022 N2 - Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback. KW - IT-Security KW - Education KW - Automotive KW - Penetration testing KW - Education framework Y1 - 2022 UR - https://www.thinkmind.org/index.php?view=article&articleid=cloud_computing_2022_1_10_28001 SN - 978-1-61208-948-5 SP - 1 EP - 6 PB - IARIA CY - [Wilmington, DE, USA] ER -