1. Using An Isolated Network to Teach Advanced Networks and Security
LTC John M.D. Hill
LTC Curtis A. Carver Jr.
CPT Jeffrey Humphries
Dr. Udo W. Pooch

2. Agenda Introduction Active Learning and Cooperative Groups
Lab Architecture
Issues in Building a Security Lab
Questions and Conclusions
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

3. Introduction
Texas A&M University has been teaching a graduate class in Computer Security since The class utilizes an isolated network security lab to prove a cooperative, active learning opportunity for the students.
The purpose of the class is to teach students about network security in an active learning environment.
The purpose the security lab is to isolate the effects of this active learning from the rest of the campus and departmental networks.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

4. Introduction (continued)
The lab is isolated by a combinations of hardware and software safeguards:
All components of the lab connect to a single router.
The router’s gateway is through a proxy firewall server. Students can access the lab remotely only by logging into the firewall.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

5. Active Learning 70% of the student’s grade is the lab exercise.
Students must learn and actively apply classroom lessons in order to pass the course.
The exercise is self-directed. Students must research, code, and implement solutions to the exercise.
Students do not attack passive systems. Instead, the systems are actively being defended by fellow students.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

6. Persistent Learning Groups
Students must work together as a team because:
The problem presented to students is too complex and time-consuming for one student to solve.
The exercise is weighted heavily. Without success in the lab, students will fail.
Students learn more from each other than they ever would from a professor.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

7. Lab Architecture Inferno 1 Router Firewall Heaven Inferno 2 Arcadia
Gabriel
Server Switch
Attack Switch
Inferno 4
Utopia
Research Switch
Inferno 5
Research 5
Limbo
Research 4
Boot Server
Research 1
Research 2
Research 3

8. Attack Components These are the student attack platforms.
Each student team has access to a SPARC workstation and personal computer that is configured to run both Window NT and LINUX.
This allows the students to attack using three different operating systems.
Student teams have complete configuration control over their attack platform and may enable or disable whatever services they desire.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

9. Server Components
These components are generally the systems the students are attacking.
There are some component systems that are off-limits (St Peter, Boot Server).
There are some components that can be attacked that the students do not know about (Gabriel).
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

10. Sever Components (continued)
The remaining systems present a variety of operating systems with different levels of security:
Limbo SunOS 2.4 system with no security patches.
Utopia is Solaris 2.5 system with the latest security patches and standard services.
Xanadu is a hardened server with the latest security patches and limited access.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

11. Server Components (continued)
Heaven is a Window NT and HTTP server with the latest patches applied.
Arcadia is a Linux server.
Gabriel is a remote logging station.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

12. Research Components
These components are research systems that can be used to develop and analyze security systems in a hostile environment.
As an example, they are currently being used to evaluate intrusion detection systems that feature active intrusion response mechanisms.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

13. Additional Security Tools Employed
Tiger – vulnerability scanner
Tripwire – Integrity checker
TCPWrapper – network protocol tool
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

14. Issues Delineation of lab and real world activities.
Protection of the network lab so that it cannot be used to launch attacks outside of the lab.
The high maintenance cost of providing a mix of operating systems at different levels of security.
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference

15. Questions and Conclusions
11/20/2018
Presented to the 32nd Technical Symposium on Computer Science Education (SIGCSE) Conference