A Laboratory Based Capstone Course in Computer Security for Undergraduates
Mike O'Leary
Department of Computer and Information Sciences
Towson University
Supported by the National Science Foundation
DUE - 0113783

The Course

Case Studies in Computer Security

Capstone course for undergraduates in the computer security track.

Arranged around a sequence of competitive, team-based laboratory exercises.

~6 exercises over the 1 semester course

Each exercise has a ~1 hour live component

Exercises: Structure

Four teams of students participate in each exercise.

Students collaborate with their own team, and compete with other teams.

Exercises: Preparation

Students design and construct their own networks.

They use a variety of operating systems

They set up and securely configure one or more remote services

Exercises: Preparation

Each team is provided with authentication credentials to some of the other teams.

No team has root equivalent credentials on a machine from another team.

No team has all of the non-root credentials for any other team.

No team knows which opposing team(s) have credentials for the services in their network.

Exercises: Live

During the exercise, teams:

Verify that the services offered by opposing teams are running correctly by using their provided credentials.

Attempt to gain access to services for which they do not have credentials, and to the host itself.

Exercises: Analysis

Teams must determine who accessed their services.

Did they do so legitimately or not?

Similar Courses

Long history of hands-on security courses.

Huss (1995)

Similar courses are often “cyberwar” courses

Micco & Rossman (2002)

Wagner & Wudi (2004)

“Capture the Flag” courses

Eagle & Clark (2004)

Walden (2005)

Philosophy

Emphasis is on defense and administration, not attack.

What is the best use of (limited) time?

Our audience are future administrators and security officers, not penetration testers.

Emphasis is on networks, rather than on individual machines.

Curriculum

Programming

Languages

(COSC 455)

Operating

Systems

(COSC 439)

Networks

(COSC 350)

Discrete

Mathematics

(MATH 263)

Introduction

to Information

Security

(CIS 377)

Computer

Ethics

(COSC 418)

Cryptography

(MATH 314)

Network

Security

(COSC 450)

Operating

Systems

Security

(COSC 440)

Application

Software

Security

(COSC 458)

Case Studies in

Computer Security

(COSC 481)

Facilities

Dedicated security laboratory

28 high-end hosts running VMWare & Software server

Private network

Each host can run 6+ guests simultaneously

Windows (2000, XP)

Linux (Red Hat 7.0, 7.3, 9.0; Suse 9.3; CentOS 4.0)

BSD (FreeBSD 4.10, 5.4)

The Network

Team 1

Team 2

Team 3

Team 4

Software Server

Course Topics

Account & password management.

Best practices.

PAM.

Password crackers. John the Ripper; Cain & Abel.

Logging & Auditing. Log servers.

Simple reconnaissance

ping (fping, icmpenum, icmpquery)

nmap.

Course Topics

Packet sniffers; Ethereal.

Common services

IIS

Apache (1.x, 2.x)

WU-FTPD, vsftpd

OpenSSH

MySQL

Intrusion detection systems; Snort

Course Topics

Remote access & backdoors

netcat

VNC

rdp

Advanced reconnaissance

Null connections; NetBIOS enumeration

SNMP walking

Course Topics

Firewalls

iptables

Students write full featured firewalls for small networks, including NAT.

Security analysis tools

Nessus

Microsoft Baseline Security Analyzer

The Logging Lab

Each team must set up:

Three Windows targets

Three non-administrator accounts, and specified password policies.

Windows file shares

Three Linux targets

Three non-root accounts, and specified password policies.

SSH server

A central logging server.

The Logging Lab

After the live portion of the exercise concludes, students need to determine what happened to their own network.

2/3 of the grade is based on the log analysis.

1/3 of the grade is based on preparation and what the team did to others.

More Exercises

Reconnaissance Lab

Systems Lab

Experiences

Murphy is not our friend, but a constant companion.

Networking

Hardware

Software

Even the instructor does not know what is actually occurring during the live exercises.

Experiences

Students find interesting ways to make the class hard for themselves.

Experiences

Lateral learning.

Students learn more from each other and from independent work than they do from my lecturing.

Results of the live exercises are a surprise to the students, and give the class realism.

Workload

Preparation

Hands-on examples are a mainstay of the course.

These are time-consuming!

Examples change from year to year.

Grading.

Grading

Grading these exercises is difficult.

Students need to keep good records.

Two passes are needed to grade the reports

First, try to determine what actually occurred

Second, try to determine what the students actually detected.

Certainty is often impossible.

Student Reaction

Students like the course

“Great class, we need more classes like this.”

“The class was great!”

But wish it could be longer

“The time for the class should be increased!”

“Class needs to be longer.”

Questions?

Contact information

Mike O'Leary

Department of Computer and Information Sciences

Towson University

Towson, MD 21252

moleary@towson.edu

SIGCSE 2006

Mike O'Leary

2006-02-20T13:51:53