2026 ASEE Annual Conference & Exposition

Traditional cybersecurity education emphasizes theoretical knowledge and case study analysis, which inadequately prepares students for real-world embedded security challenges and current workforce demands in critical industries such as healthcare. This work reports on an eight-semester implementation of a hands-on, research-based approach for teaching embedded systems security to undergraduate students through a medical device hardware testbed. The curriculum is delivered as a multi-semester undergraduate elective course at a four-year university; it adapts the Course-based Undergraduate Research Experience (CURE) model within a Vertically Integrated Projects (VIP) program structure, where students work across multiple semesters with peers, graduate student mentors, and faculty to gain authentic research experience in device security assessments.

This work details the pedagogical framework and teaching strategies supporting this testbed-centered experiential learning implementation. Core instructional activities include hardware-based programming in Python and C/C++ for device interfacing, device disassembly and hardware analysis, wireless communication security with software-defined radio experimentation, and vulnerability analysis of software and firmware. Instructional materials are organized into differentiated learning pathways that accommodate varying student backgrounds and are scaffolded to ensure appropriate challenge levels.

Assessment data demonstrates improvements in technical competency and workforce readiness, with students developing the cross-disciplinary skills demanded by employers in embedded security fields. Students report increased confidence in hands-on security analysis and complete research projects for portfolios showcasing applied skills. The vertically integrated structure benefits student retention, with continuing undergraduate students developing mentorship skills while reinforcing their technical knowledge. Reflections on course effectiveness and applicability to other courses are included. Teaching strategies, assessment techniques, and sample tutorials are included as supplementary material.