A Rigorous Approach to Teaching Access Control

Access control is central to any study of security. Verifying that access control is correctly implemented is essential but difficult, because meaningful verification requires formal derivations and proofs. We present an approach to teaching access control using an access-control logic based on modal logic. Students use the logic to formally describe and analyze a variety of access-control scenarios. The access-control logic plays a role analogous to that played by propositional logic in hardware design. We have developed a short course consisting of detailed presentations, examples, in-class exercises, homework projects of increasing complexity, and grading rubrics. These components were developed with detailed educational outcomes and outcomes-based assessments in mind. We have taught this short course in one 8-hour day as part of the Advanced Course in Engineering in Cyber Security to 49 rising juniors and seniors drawn from universities across the US. We present the design details of our short course, our experience, and lessons learned.