Introducing security analysis in computer security courses through an electronic voting project

For courses in computer security, one of the more difficult skills to impart to the students is the ability to conduct methodical security analyses of computer systems. One must create a system that is sufficiently complex to generate non-trivial security issues while avoiding completely overwhelming the students. To that end, we have developed a new course project based on the design and evaluation of physical electronic voting systems, a problem area that is sufficiently complex, yet relatively easy to understand. In this paper, we will discuss the project with regards to higher level learning objectives (analysis, evaluation) as well as give observations and refinements made through offering the project over multiple years in an upper-division computer security course.