Vergleich von Lehransätzen für die Ausbildung in IT-Sicherheit

English title: Comparison of approaches for the education in information security There’s a tendency in IT security education at universities to not only teach defense mechanisms but also attack techniques. Increasingly more universities offer special labs, where students can experience both the attackers’ and the security administrators’ view. A more competitive form of such labs are the so-called Capture-The-Flag contests. Getting to know the attackers’ side is thougt to lead to a better understanding of IT security and its problems compared to teaching only protective techniques. The authors’ experiences with teaching attack techniques during his time at RWTH Aachen University and Mannheim University starting in 2003 were very positive. These experiences led to the question if it is possible to assess the contribution of the approach regarding the education of security professionals. This requires the IT security knowledge of students to be measured. For this purpose an empirical study was designed and conducted, with the goal of assessing the impact on the understanding of information security of university students. As part of the study, students attend a specially crafted course on IT security where adequate measures determine the effect of that approach. To conduct the empirical study, the study needs to be specified, the IT security courses will be created and conducted and tests to measure IT security knowledge will be designed. This thesis analyzes the situation of IT security education at German and international universities. And it presents the design and the implementation of the mentioned empirical study. The study compares two approaches: the approach to be assessed and the one that focuses on defense mechanisms. To this end for each of the two approaches an introductory course on information security with theoretical and practical elements was designed. The evaluation of the empirical data gathered in the study showed a tendency in favor of the approach with focus on attack techniques, but the difference is not significant enough. To come to a conclusion regarding the assessment of the approach more empirical data has to be collected by repeating the study.