3

I've been a software developer for about 10 years or so and am familiar with various security related concepts (SQL injection, server-client validations, man-in-the-middle attacks, etc.)

I'm upgrading from a college diploma and found myself sitting in an "Enterprise Application Development" class learning about SQL.

The core content is very basic and normally doesn't cover security, but the teacher decides to talk about it. He advised students to use mixed cased table names as "security" so that it is harder to guess. This is known as "Security Through Obscurity" and is one of the least effective form of security (it is treated as insecure). Security is talked about throughout the class and they're all forms of the same thing and extremely dangerous since it is completely ineffective.

As a professional that knows better, if he was an employee I would've had to sit him down and have a thorough talk, and probably advise some security training.

What can do I do as a student? Since the other students are probably clueless and security is not even one of the program's topic, there is no foreseeable chance for correct learning and they will probably end up doing this in the future, possibly jeopardizing their own career, the company, and all the data they work with.

  • 1
    Does the professor seem generally reasonable? – Patricia Shanahan Jan 10 at 4:27
  • 6
    If the prof is reasonable, then you could take him to the side after lecture and suggest to him better ways towards security and why this method does not work. But be very aware of not using a patronising attitude ("I would've sit him down and have a thorough talk ..."). Most profs I know are happy to learn, but they have considerable experience in their main field of expertise and, while they will be happy to improve their knowledge, they won't be reacting well to be reprimanded like recalcitrant beginners. – Captain Emacs Jan 10 at 4:33
  • sounds like an answer @CaptainEmacs – Mark Jan 10 at 8:27
  • 1
    @CaptainEmacs Sorry, that line was suppose to mean that the degree of misinformation is very severe. That line was suppose to indicate my response if I was a manager of an employee. I didn't imply I can do this to a professor, so hence the question. – Nelson Jan 10 at 8:28
  • @Nelson Understood. I think Patricia's answer below is probably a good version of what I would try to say, too. – Captain Emacs Jan 10 at 14:56
6

If the teacher is not a reasonable person, and some are not, you should keep your head down and hope that your fellow students will get some real security training, at least on the job, before making decisions in this area.

If the teacher is reasonable, select a very small number of references on the topic, preferably including peer-reviewed papers. Look for an opportunity to talk with the teacher privately, definitely not in class and preferably without any of your fellow students nearby.

Explain that you have had to learn about some security issues because of your jobs over the last 10 years, and that you have more up-to-date information than is being presented in class. (Yes, I know something of the history of security-through-obscurity, but we are being tactful here). Offer your references. How you play it from there on will have to depend on how receptive the teacher is, and how helpful you are willing to be.

4

I don't know enough of the details to actually judge, but there is a benign explanation. You say the the course overall is quite elementary. You also say that it is focused elsewhere than security and that this is a side topic. Let me start with that.

There is a Pedagogical Pattern called Spiral in which it is suggested that advanced topics can be mentioned in early courses just to put out a few terms and to put the ideas into the heads of students so that when they see the topic later, in a more complete way, they have already seen a few basic ideas. The later course then builds on the earlier base. So, learning is a spiral with each loop being deeper than the earlier one.

Unless the instructor is presenting obscurity as an important security technique, perhaps they are just introducing the idea that security, itself, is an important consideration (to be explored later). After all, if they give the complete course in security within the current course it can't meet its objectives. It would be bad, of course, if they suggest that obscurity is sufficient.

Look at the overall picture before you make a judgement. You may not need to challenge the professor, but it might be worth a visit to the office to see what their goals are in opening the door to security in this way. In general, mentioning advanced things early to set the stage for later development is a good thing that gives students a bit of perspective on the whole field.


Related to this is that instructors teaching a first programming course might have students implement something simple like the Caesar Cypher, and mention the idea of encryption, but not suggesting that this is a good one.

  • Although this is a possible explanation, there are much better choices than security-through-obscurity that could be used to introduce the idea of security in an elementary SQL course. – Patricia Shanahan Jan 10 at 13:55
  • @PatriciaShanahan, yes, of course. – Buffy Jan 10 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.