The Challenges of Teaching an Interdisciplinary IA Course Rose Shumba Indiana University of Pennsylvania EPASEC 2006

Overview of talk Overview of the COSC 316 course –Course background –Concepts and hands on exercises covered –Teaching resources Experiences and challenges So, what? Possible solution

Course background Interdisciplinary course for the Criminology, Business students, Communications, and Computer. Introduces the theory and concepts of host computer security. –Security building blocks for a Linux host Pre-requisite -Problem Solving and Structured Programming.

Main concepts covered Users, Passwords and authentication Users, Groups and the Super user, File systems and Security Cryptography Basics Defending accounts Integrity Management Auditing and Logging Vulnerability assessment Introduction to digital forensics

Basis for the course “The security blocks form a sound defense strategy of multiple layers. If one layer is penetrated, there are still other layers of protection. “

Hands-on exercise Introduction to Unix commands and utilities Password crackers, PAM module, integrity checking, password configuration files. User Private Groups and sharing of devices in groups. Defending accounts utilities- protecting of root account, sudo utility, sudoers files, checking for root kits, lsof tool

Hands-On exercise File permissions- use of chmod and umask utility, sticky bit, SUID bit, SGUID bits Tripwire tool for integrity checking Auditing and logging- use of logging tools; swatch, logcheck, logrotate, pacct. PGP tool; sending keys to the server. Tool capstone project-Sara, Rat, Nessus, Hunt, Ethereal, Squid, Satan, Protsentry, and Internet Security Scanner.

Teaching Resources An isolated network security laboratory with 22 Red Hat Linux 9.2 servers, 10 Cisco 2600 series routers and 10 PIX firewalls. Text: Garfinkel. S, Spafford, G, Schwartz. A; Practical Unix and Internet Security; O’Reilly; Third edition; 2003.

Positive experiences Linux is free; we are using Red Hat 9.1. There is an abundance of freely downloadable Linux security tools. Tutorials and documentation are available with most of the tools, which can be tailored to one’s teaching environment. Positive feedback has been received from students on the use of hands-on exercises.

Positive experiences The password cracking, accounts defending, groups security, Tripwire, PGP exercise and the capstone tool project were very interesting as for activities performed (from student evaluations).

Challenges Research tool exercise is interesting for computer science majors but a challenge for non-computer science majors. –Extensive documentation with some of the assigned tools. –The challenging installation process –some tools require advanced Unix/Linux knowledge, and, –Output from some of the tools is sometimes not easy to understand it requires an understanding of basic network concepts.

Challenges There is a need to include Windows tools as highlighted both in the course student evaluations and by the dept Interns. Windows tools are however usually commercial. Given a choice between Windows and Linux, 95% of the students chose Windows Trial versions for the capstone project.

Solution Designed a prerequisite for this course COSC216 to introduce students to the Windows and Linux operating systems and basic information assurance topics. Course has only been taught once.