1. An Isolated Network in Support of an Advanced Networks and Security Course LTC Curtis A. Carver Jr. LTC John M.D. Hill Dr. Udo W. Pooch

2. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference2 Agenda Introduction Lab Architecture – Black Components (attacking computers) – Gold Components (attacked computers) – Grey Components (research systems) Issues in Building an Isolated Lab Questions and Conclusions

3. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference3 Introduction Texas A&M University has been teaching a graduate class in Computer Security since 1995. The class utilizes an isolated network security lab to prove a cooperative, active learning opportunity for the students. The purpose of the class is to teach students about network security in an active learning environment. The purpose the security lab is to isolate the effects of this active learning from the rest of the campus and departmental networks.

4. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference4 Introduction (continued) The lab is isolated by a combinations of hardware and software safeguards: – All components of the lab connect to a single router. – The routers gateway is through a proxy firewall server. Students can access the lab remotely only by logging into the firewall.

5. Lab Architecture Hell 1 Hell 2 Hell 3 Hell 4 Black Switch Gold Switch Router Firewall Gray Switch Heaven Arcadia Utopia Gabriel Limbo Grey 1 Hell 5 Boot Server Grey 2Grey 3 Grey 4 Grey 5

6. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference6 Black Components These are the student attack platforms. Each student team has access to a SPARC workstation and personal computer that is configured to run both Window NT and LINUX. This allows the students to attack using three different operating systems. Student teams have complete configuration control over their attack platform and may enable or disenable whatever services they desire.

7. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference7 Gold Components These components are generally the systems the students are attacking. There are some Gold component systems that are off-limits (St Peter, Boot Server). There are some components that can be attacked that the students do not know about (Gabriel).

8. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference8 Gold Components (continued) The remaining systems present a variety of operating systems with different levels of security: – Limbo SunOS 2.4 system with no security patches. – Utopia is Solaris 2.5 system with the latest security patches and standard services. – Xanadu is a hardened server with the latest security patches and limited access.

9. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference9 Gold Components (continued) Heaven is a Window NT and HTTP server with the latest patches applied. Arcadia is a Linux email server. Gabriel is a remote logging station.

10. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference10 Grey Components These components are research systems that can be used to develop and analyze security systems in a hostile environment. As an example, they are currently being used to evaluate intrusion detection systems that feature active intrusion response mechanisms.

11. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference11 Additional Security Tools Employed Tiger – vulnerability scanner Tripwire – Integrity checker TCPWrapper – network protocol tool

12. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference12 Issues Delineation of lab and real world activities. Protection of the network lab so that it cannot be used to launch attacks outside of the lab. The high maintenance cost of providing a mix of operating systems at different levels of security.

13. Copyright © 2000 Curtis Arthur Carver, Jr., and John Mitchell Duval Hill. All Rights Reserved. This document may freely be reproduced provided that it is distributed intact and includes the copyright statement and this requirement. References to cited authors available upon request. Contact hilljmd@tca.net. 3/16/00Presented to the 13th Annual Federal Information System Security Education Association (FISSEA) Conference13 Questions and Conclusions