Using An Isolated Network to Teach Advanced Networks and Security LTC John M.D. Hill LTC Curtis A. Carver Jr. CPT Jeffrey Humphries Dr. Udo W. Pooch

Agenda Introduction Active Learning and Cooperative Groups Lab Architecture Issues in Building a Security Lab Questions and Conclusions 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Introduction Texas A&M University has been teaching a graduate class in Computer Security since 1995. The class utilizes an isolated network security lab to prove a cooperative, active learning opportunity for the students. The purpose of the class is to teach students about network security in an active learning environment. The purpose the security lab is to isolate the effects of this active learning from the rest of the campus and departmental networks. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Introduction (continued) The lab is isolated by a combinations of hardware and software safeguards: All components of the lab connect to a single router. The router’s gateway is through a proxy firewall server. Students can access the lab remotely only by logging into the firewall. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Active Learning 70% of the student’s grade is the lab exercise. Students must learn and actively apply classroom lessons in order to pass the course. The exercise is self-directed. Students must research, code, and implement solutions to the exercise. Students do not attack passive systems. Instead, the systems are actively being defended by fellow students. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Persistent Learning Groups Students must work together as a team because: The problem presented to students is too complex and time-consuming for one student to solve. The exercise is weighted heavily. Without success in the lab, students will fail. Students learn more from each other than they ever would from a professor. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Lab Architecture Inferno 1 Router Firewall Heaven Inferno 2 Arcadia Gabriel Server Switch Attack Switch Inferno 4 Utopia Research Switch Inferno 5 Research 5 Limbo Research 4 Boot Server Research 1 Research 2 Research 3

Attack Components These are the student attack platforms. Each student team has access to a SPARC workstation and personal computer that is configured to run both Window NT and LINUX. This allows the students to attack using three different operating systems. Student teams have complete configuration control over their attack platform and may enable or disable whatever services they desire. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Server Components These components are generally the systems the students are attacking. There are some component systems that are off-limits (St Peter, Boot Server). There are some components that can be attacked that the students do not know about (Gabriel). 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Sever Components (continued) The remaining systems present a variety of operating systems with different levels of security: Limbo SunOS 2.4 system with no security patches. Utopia is Solaris 2.5 system with the latest security patches and standard services. Xanadu is a hardened server with the latest security patches and limited access. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Server Components (continued) Heaven is a Window NT and HTTP server with the latest patches applied. Arcadia is a Linux email server. Gabriel is a remote logging station. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Research Components These components are research systems that can be used to develop and analyze security systems in a hostile environment. As an example, they are currently being used to evaluate intrusion detection systems that feature active intrusion response mechanisms. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Additional Security Tools Employed Tiger – vulnerability scanner Tripwire – Integrity checker TCPWrapper – network protocol tool 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Issues Delineation of lab and real world activities. Protection of the network lab so that it cannot be used to launch attacks outside of the lab. The high maintenance cost of providing a mix of operating systems at different levels of security. 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

Questions and Conclusions 11/20/2018 Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference