Disclaimer

Quick disclaimer before I get started. I no longer work at this job. Any opinions expressed here are entirely my own. And if you are a former student of mine, no personal identifiable Information (PII) will be mentioned, in accordance with federal law.

Overview

For the past couple years, I worked as a Cyber Security TA with the University of Minnesota. At least, that’s what I told people. In reality I worked for a teaching firm call EdX/2U, that was contracted by the universities. All of my work was done with Minnesota, I didn’t work with any other universities.

This was a remote job, everything was done online. Teaching over Zoom, work stuff though slack and email. But that didn’t stop students from thinking I was physically at UofM. It was kinda fun to tell them that I’ve never been to Minnesota.

Teaching

Teaching for me was pretty easy, because I didn’t have to. The prof did all that. Though I did have to sub for him every now and then. My main job was to handle the students, deal with questions in slack, and grade things. The prof would also deflect some questions he didn’t know to me, mostly Mac stuff.

Our teaching material was all pre-done for us. This was handy, as we didn’t have to do that ourselves. But also a pain. As we had to make regular corrections. Slide corrections had to be submitted by a form. Everything else could be submitted by a git pr.

Grading

Grading was easy. Mainly because we had a central department for grading homework. I did have to grade projects though.

Grading isn’t hard, just time consuming. The hard part was just getting some students to submit their stuff. And not to plagiarize.

Plagiarism

This was an issue from day one. Students copying each other’s work, or worse, having ChatGPT do it for them.

As annoying as it sounds, I kinda liked dealing with it. For basic coping (be it from another student, or GitHub), I’d find the source, and generate a comparison report in Beyond Compare, then confront them.

Confronting them is the hard part. First thing I did was lay out my examples. Explain what’s what, and go over the similarities. Then ask them the main question.

Confronting them about AI, was actually easier. Using some AI “detection” tools¹, I could build a report, and confront them. Typically first going over the university’s policy. Then presenting the reports and asking “Can you tell me, why your answer, is consistent with that of an AI?”. That usually got them to spill. Though not always.

By the time we got to the interview, our decision was already made. We’d usually give them one resubmit, a second chance. After that, we’d give them a zero.

Projects

The course had four projects. Spanning a good chuck of what we went over. And they were a huge part of the final grade. If one was skipped, or got marked incomplete, or invalid (see above), it was an automatic failure of the course.

Proj 1

Project one started right after we went over cloud security. So it was on cloud security. Kinda, not really. The project was to deploy a static website in Azure app services. Pretty simple. You would think.

The ways students would find to mess this up, was huge. A common one was typing in the placeholders in a command, instead of replacing them with what the instructions said.

The worst one, was a student who used an online site generator. Bypassing all of the Azure stuff that the project required. The student was all proud on how they did this. Instead of doing the Azure deployment, and hand making the site, as required. A simple “This does not meet the requirements, you will get a zero if you submit this” got them to fix it.

proj 2/3

Project two and three were pretty simple. Two was just breaking in to a couple networks (first Linux, then Windows). Three was the the other side of the coin. Looking a past cyber event in Splunk, and figuring out what happened.

The only issue we had with project two, was the scoreboard. We used CTFd to keep track of found flags in the break ins. The only issue was getting a company hosted CTFd server. I gave up and just started hosting my own in ProxMox (with ssl, on a domain. Unlike the company ones), so we never and to fight for one. The Profs I worked under loved that.

Proj 4

Project four was the big one. A research project, that had to be presented on the last day of class. Grades were on the line, as grading was done live, and was final. No resubmits.

Students got to pick their own topic, with some restrictions. The project had to be cybersecurity related, and couldn’t be illegal (some walked that line (those were my favorite)).

This mostly resulted in disappointment, with one or two “good” ones. Here’s a list of the biggest disappointments.

• I bought a Flipper Zero (didn’t do anything with it, just said they bought one).
• Copying files from a server I’m allowed to copy from (said the was a security issue, even though their account had permission to copy files).
• Played a pre-recored presentation (without sound (after being told you can’t pre-record the presentation)).
• Caesar cypher.
• Running ducky script over bluetooth (why is this here? Because they just used a built in demo script, instead of writing their own).

The list goes on, as you might expect. I will say, my most favorite presentation, was the most DEFCON like. A student social engineered his was in to their wife’s bank account, using a sign language interpretation service. Yes he had permission to attempt this form her, and he got a 100%.

Exit

Around early December, we were told that our department was being dissolved. Some of us would be kept on for one more semester, and the rest for only half (to fill in as subs).

We knew for a while, that EdX had to change, or it would die. The two major issues (in our eyes), were that the teaching materials needed updating, and we really, really needed an entry exam. Anyone could sign up for a 24 week class, that dived head first in to UNIX, networking, and breaking in to Linux boxes.

In addition to an entry exam, EdX also needed to offer a computer literacy class. For those that didn’t pass the exam, to take first. Too many didn’t know how to use their computers, at all. ²

As for the whole working remote thing. It had its ups and downs. Being able to work from anywhere was great, but it ment I didn’t have a separate work place. And I also had to have a lot of work stuff on my Mac. But I could also play Factorio during lecture.

Am I going to miss teaching, yes. Am I going to miss how EdX ran things, not at all.