Chao-Hsien Chu, Ph.D. Abdullah Konak, Ph.D. College of Information Sciences and Technology The...
-
Upload
aron-rafe-flowers -
Category
Documents
-
view
223 -
download
0
Transcript of Chao-Hsien Chu, Ph.D. Abdullah Konak, Ph.D. College of Information Sciences and Technology The...
Chao-Hsien Chu, Ph.D.Abdullah Konak, Ph.D.
College of Information Sciences and TechnologyThe Pennsylvania State University
University Park, PA 16802
Virtual Security LabsVirtual Security Labs
May 11, 2009
Presentation OutlinePresentation Outline
Overview:- The Special Needs for IA Education- Common Approaches- The Challenges- Motivations for VSL
VSL Implementation at UP / Demon
VSL Implementation at Berks /Demon
Lessons Learned
Questions and Discussion
The Special Needs for IA EducationThe Special Needs for IA Education
Hands-on exercise is a critical and integrated component of any effective information security education and training program.
Students are expected to experiment with security software without worry that their experiment may impact other computer systems / students.
Students should be able to evaluate the security of different operating systems, attempt to compromise the security of computer systems, and install additional security mechanisms without concern that their actions may affect other computers systems / students.
Security hardware (Firewall, IDS); Human factors; Defense-in-depth; Multidisciplinary.
• IST 515: Information Security & Assurance• IST 564: Crisis, Disaster & Risk Management• IST 596: Individual Studies• SRA 472: Integration of Privacy & Security• SRA 468: Visual Analytics for Intelligence &
Security
Prediction Detection Forensics Response
Defense In Depth of SecurityDefense In Depth of Security
Feedback
IST 451
IST 515 SRA 468
• IST 451: Network Security
• IST 452: Legal & Regulatory Issues
• IST 453: Computer Forensics Law
• IST 454: Computer & Cyber Forensics
• IST 456: Security & Risk Management
IST 453
IST 454 IST 564
IST 456IST 452
SRA 472 Liu Zhu
Xu
Bagby
Chu McGill
Xu
Chu
Cai
Chu Liu Squicciarini
• Policy/Regulation
• Firewall/DMZ
• Access Control/VPN
• Qualitative models
• Quantitative models
Prevention
Bagby
• Plans• Risk analysis
• Scanner• IDS• Data mining
Common ApproachesCommon Approaches
Some instructors require students to complete the exercises using their own computers.
Lab experiences are typically conducted in an isolated computer lab where security problems that may occur are unable to affect other computers on campus.
A common alternative is to develop a virtual network environment using simulators:- Virtual Network System (VNS).- Use virtual machines (VM) to emulate the hardware of different computers in a network.
Virtual Gaming /Simulation (2nd Life)
The ChallengesThe Challenges
The number of security related courses are increasing.
The number of students interested in SRA are increasing.
The physical space for security lab remains the same or reduced.
Difficulty in maintaining an isolated security lab to meet classes and students’ schedules.
Need to accommodate commuter students. Need to provide distance-learning education. Lack of emulators for security hardware
Security Related CoursesSecurity Related Courses
IST 220: Networking & Telecommunications IST 402: Emerging Issues and Technologies IST 451: Network Security IST 454: Computer and Cyber Forensics IST 456: Security and Risk Management SRA 111: Security and Risk Analysis (Introduction) SRA 211: Information Security (Overview) SRA 311: Risk Management IST 515: Information Security and Assurance IST 554: Network Management and Security IST 564: Crisis, Disaster and Risk Management IN SC 561: Web Security and Privacy
Distance Learning ProgramsDistance Learning Programs
Associate in Science in Information Sciences and Technology. http://www.worldcampus.psu.edu/AssociateInInformationSciencesandTechnology.shtml. (IST 220)
Bachelor of Science in Information Sciences and Technology. http://www.worldcampus.psu.edu/BachelorinIST.shtml. (IST 220)
Master of Professional Studies in Information Sciences. Information Assurance and Decision Support Option. (Fall 2009). (IST 451, IST 454, IST 515, IST 554, IN SC 561)
Master of Professional Studies in Homeland Security. Information Security and Forensics Option (Fall 2010).
Motivations for VSLMotivations for VSL
Increasing advanced hands-on learning in networking and security courses (without sacrificing from content).
Making campus computing resources available to commuter students for 7/24.
Providing hands-on learning experiences in a distance learning model.
Reducing lab hardware, software, and maintenance costs, and the need for specialized computer labs.
Providing an agile and secured computing environment.
Virtual Machine / EnvironmentVirtual Machine / Environment
• Virtual machines are software emulations of fully functional operating systems such as Windows XP, Windows Sever 2008, and Linux.
vslvc.ist.psu.edu
ESX Server
VICUP Architecture
IST 515: Penetration Test LabsIST 515: Penetration Test Labs
Lab 1: Security Policy Lab 2: Footprinting. Whois, Nslookup, Dig, Ping, Traceroute. Lab 3: Network Scanning. SuperScan, Netbrute, NMap. Lab 4: Enumeration. LANguard Network Security Scanner,
ENUM, SNScan. Lab 5: Applied Cryptography. Hash, Vigenere Cipher, AE
Block Cipher, IDEA Cipher. Lab 6: Network Sniffing. Ethereal, WinCap. Lab 7: Network Security Audit. NMap, Nessus. Lab 8: Web Security. Social Engineering & Phishing Lab #: Password Cracking Lab #: Denial of Service
NMware Infrastructure ClientNMware Infrastructure Client
student1; z7heMu=astudent2; K9dehe-+student3; p?u+haMastudent4; wu7Et+=qstudent5; Su8*2Frustudent6; 8RA+aGusstudent7; gA7enu@Astudent8; 2E!$A7ucstudent9; nup#speDstudent10; s4he&uWRstudent11; 54gUN-sestudent12; t2e!afRestudent13; -Um5Mahustudent14; &akUse8$student15; 8rusTu#r
Lessons LearnedLessons Learned
It allows students to gain hands-on experiences without the need of physically attending labs on campus.
Instructors can use the system in class to enhance teaching and discussion anywhere and anytime.
Assignments can be designed without limited by the available computing resources.
Students are able to experiment with security software without worry that their experiment may impact other computer systems.
Students can evaluate security of different operating systems, attempt to compromise the security of computer systems, and install additional security mechanisms without concern that their actions may affect other computers.
IST 454: Computer & Cyber ForensicsIST 454: Computer & Cyber Forensics
Lab 1: Data Acquisition – Imaging. Lab 2: Forensic Analysis (EnCase, FTK) Lab 3: Investigating Windows Systems Lab 4: Data Hiding and Steganography. Lab 5: E-mail Tracing Lab 6: Hostile Code Investigation Lab 7: Network Forensics Lab 8: Mobile Forensics
SRA 221: Information SecuritySRA 221: Information Security
Lab 1: Keystroke Monitoring. SpyAgent.
Lab 2: Password Cracking. LC4.
Lab 3: Firewall Security. Cisco SDM
Lab 4: Encryption / Crypto. DES, MD5
Lab 5: Vulnerability Assessment. Metasploit
Lab 6: Vulnerability Assessment. Nessus.
Lab 7: Intrusion Detection. SNORT.
Penn State Berks Architecture Penn State Berks Architecture
Based on VMWare ESX Server .
User Access
a sandbox
a computer lab
virtualswitch
virtualrouter
virtual machines and networks
Host (VM Servers)
User
WWW
VM Storage
Web Server
Web Browser
VMAdmin.
Console
User Access
a sandbox
a computer lab
virtualswitch
virtualrouter
virtual machines and networks
Host (VM Servers)
User
WWW
VM Storage
Web Server
Web Browser
VMAdmin.
Console
Remote AccessRemote Access
Web Browser VMware Client Off Campus Access
Network Security Lab SettingsNetwork Security Lab Settings
Default Setting
Optional Setting
Windows 2003 Server
• Active Directory•DHCP and DNS•Certificate Server•Routing and NAT…….
Windows 2003 Server
• Active Directory•DHCP and DNS•Certificate Server•Routing and NAT…….
Two Windows XP and One Ubuntu Linux
• Loaded with security software •Web, FTP, Telnet.…….
Two Windows XP and One Ubuntu Linux
• Loaded with security software •Web, FTP, Telnet.…….
IST 402 Web & E-commerce Security (Fall 2008)IST 402 Web & E-commerce Security (Fall 2008)
Bootcamp (3 hours) • Review of computer networking, basic skills, ...
Short Class Activities (10-15 min) • Encryption, Hashing, Digital Signatures,…..
Labs (30-60 min) • Web Server Admin, Certificates, SSL, IPSec / VPN, ….
Assignments• Certificates & HTTPS, Proxy Servers, SSH Tunneling,…
Term Project (Sandboxes) • Database Security and RADIUS Authentication
Demon: Certificates & HTTPS (Assignment)Demon: Certificates & HTTPS (Assignment)
Learning Objective• Describe how digital certificates and SSL are used for
authentication and data confidentiality.
Activity Summary• Change lab settings • Create a certificate request for the web server • Request a web server certificate from a Certification Authority• Download the certificate• Install the certificate and configure the web server (IIS) for SSL• Test HTTPS• Capture and analyze SSL and HTTPS packets
Certificates & HTTPS Review QuestionsCertificates & HTTPS Review Questions
What type of information could be encoded in certre.txt? Answer this question considering the content of a digital certificate.
Open the certificate that you just downloaded. You will have an unknown publisher warning. What is the reason for this warning?
Find and list the information about the publisher of the certificate. What is the first three octet of your public key (in hexadecimal
numbers)? Can you use the certificate that you created in the Internet to
provide data confidentiality and integrity between your web server and other client computers? Why or Why not?
Can you use the certificate that you created in the Internet to authenticate your web server to client computers? Why or Why not? What do you need to do so?
IST 402 Student Responses IST 402 Student Responses
“The virtual computer network gave me the opportunity to take the theoretical aspects of the course and make them happen in a hands-on environment.”
“It is a great way to have hands on with a linux server or other operating system virtually from home. This is a real interaction experience.”
“Access to software not available on student computers is awesome...”
“Very nice for experimenting on things that students could not otherwise do.”
My Observations IST 402 My Observations IST 402
Reduced time for each hands-on activity Much more comprehensive activities Less number of visits to the IT department Higher quality term projects Easy to maintain and update Empowered students
Problems Problems
Slow at times (12 concurrent users) Single point of failure User administration Scheduling and coordination
Multiple ServersMultiple Servers
Third party software
Third party software
Thank You?
Any Question?