I need help to create a Network security course

The school where i use to teach asked me about to create a course about "network security" (in fact they asked me a course about "network hacking", but i really dont like that expression).
- Course duration: 40 hours
- pre-reqs - basic knowledge of linux, tcp/ip family, ethernet networks
- Must be a lab based course - all classes must be at a "lab" ..

So ive started to draft the course contents and "aproach":

- Students will use a live cd such as knoppix-std during the course - i think there is enough tools for this course
- I will build an special set of computers to be "hacked" (:) ), with several O.S. and configs.
.... and i get lost... too many possibilities :) too many tools, too many things to teach... ahhhnn... i cant focus :(
I decided to come here to ask you people what i should include on a 40 hours course, since you know that "field" better than me. keep in mind that is the a basic course.

- What tools should i teach?
- What "sample" O.S/Config? Net equipments too (routers, swtiches?)
- Which live CD do you recommend?

Any help/comments will be appreciated.

You should decide how many students you want to take the class at one time. Smaller is better, of course.

40 hours seems like alot, but in lab settings those hours will be eaten up.

I would teach the same thing two ways. One way if you just need the information off a box and you don't care about finding out who did it, and the other way would be to preserve information in case something goes to court.

With local access to a box, breaking it is easy. I would cover that with Knopix live cd distros you can get. Since most hackers are not local, you want to teach how to secure over a network ,and how to TEST to be sure that an enviroment is secure.

Etheral would be a must. Check out the tutorial that IronGeek wrote. I can't find it but here is a link to his site that has it (and lots of other good things too) http://www.irongeek.com/

good luck and keep us posted with what you plan on doing.

~Halv

I can't offer much in the way of content, but what I could advise on are teaching methods. Being a teacher myself, I can understand how one gets lost in content; you want to teach everything, and don't really know where to start. A couple of guidelines to get you started:

1. Decide what level of expertise your students will have, and what level you need/will teach to. This will help you decide what to include as you move from content area to content area.

2. Group your lessons together by content area. In other words, network security should be taught at a different time than programming security, and even if methods/tools for them are grouped together (ie on the knoppix-std cd), you should teach them seperately. Don't try to teach a little of everything, especially all at once; just focus on shorter, more specific objectives each day, pertaining to a specific area of security. Then, you can focus on bigger objectives that incorporate many of the smaller ones.

I hope some of that made sense. Designing a curriculum is a daunting task, and it will probably take a while.

If it's a course about network security all of the students are of course going to be interested in the "hacking" portion of it.

I do not know where it would fit into your cirriculum, but I would put something in there about basic system hardening and good practices for security.

As far as system hardening shutting down unused services and ports and not using default NAT addresses on home routers. These are just a few ideas there is a wealth of knowledge on this site for other basic system and network hardening practices.

Good practices could be your basic password rules, enforcement of user policy agreements. Also, they should see network security as a layered model , not focusing on firewall, IDS or individual machine policies to keep them safe, but rather the complete implementation and more importantly monitoring and proper response to security incidents.

It should also be drilled into their heads throughout the course that a reactive policy, as many network administrators seem to take, is not acceptable when it comes to security. Complacency is the enemy of security.

WARGAMES.

I think MsM has some stuff about it spread around on the site.

This will very clearly show both the hacking and the security aspect i think.

MoonWolf: im affraid its soon for War Games. But its a good idea for the following course :)
Captain: Yeap, my idea is to show most of the time "hack tools" and how to use them. Also, how to defend against them. I would like to show why "best security pratices" are good to follow and not a lot of b.s. that everybody spread out.

Hi cacosapo

Just a rather silly question, but how long is each teaching session?.............OK 40 hours, but is that 4 hours per week? errrrrrrrr...........like 4 hours per day?

To structure a course we would need to know this?

:)

Quote:

---

Originally posted here by nihil
Hi cacosapo

Just a rather silly question, but how long is each teaching session?.............OK 40 hours, but is that 4 hours per week? errrrrrrrr...........like 4 hours per day?

To structure a course we would need to know this?

:)

---

no, its a good question.
It will be offered in the following formats:

1) 8 hours/day, one week (M-F) (daylight course)
2) 3 hours/day, 3 weeks (M-F) (night course)
3) 4 hours/day, 5 weeks (Sat/Sun)

Those are the school' proposals. 1st classes will be on format #3. After we will remodel to other ones.

I am no teacher, but here are my thoughts. If I was teaching a class about network security/hacking, I would teach the course by first teaching/demonstrating a flaw (hack) and then teaching/demonstrating a fix (security). For example, teaching the kids about Buffer Overflows. You can lecture on the theory/idea behind the buffer overflow (stack smashing, layout of the stack, overwriting return addresses, NOP slides, maybe brief shellcode). You can back this lecture up with some lab work (simple C buffer overflow programs). This will let the students learn how people craft buffer overflows. Next you could lecture on preventing buffer overflows (safe C programming (strncpy instead of strcpy, non-executable stack). NOW, buffer overflows aren't necessarily NETWORK security (more programming security), but I believe this approach will be effective. You teach the student about the problem, then teach them about the solution. This will also challenge the student to see if the solution is absolute/applicable. For more NETWORK security, you could easily teach MitM ARP poisoning attacks. You can lecture on ARP requests/replies and how these are used/handled. You can also lecture on switch ARP tables and how switches work. You could then lecture on the theory behind ARP poisoning. A good lab project here, and this is very vague, would be to setup a small switched network to perform MitM attacks. You can have one test machine sending network packets with certain information in them (ftp password, telnet passwords, http password, basically anything cleartext) and grade the students on their ability to ARP poison and sniff the passwords. You can then lecture on a solution. Static ARP tables is one possible solution, but can be a pain in the @$$. Nevertheless, you see where I am going with this. You lecture on the theory of a hack/exploit, let the students demonstrate their understanding of your lecture in the lab, and then lecture the students on solutions. That is my opinion =\ Good Luck with the class, sounds like it will be fun

Quote:

---

What tools should i teach?

---

Foot print......................Nmap,

Vulnerability..................Nessus,

password crack.............John the ripper,

sniffers..........................ettercap.

Although, I think the prinsciples, rather than the tools, are more important.

Quote:

---

What "sample" O.S/Config? Net equipments too (routers, swtiches?)

---

What ever you use needs to work straight out off the box. You do not want to spend half the lesson configuering the network, although, that! in it's self, may be a valuable first lesson??.

Quote:

---

Which live CD do you recommend?

---

The fastest, I wish I could help you here. I'm only familiar with Knoppix STD

NMAP scanning will be good for teaching about ports/services, Network Packets, TCP flags, etc.

ARP poisoning, like I said, can teach about ARP, switched networks, packet sniffing, etc

DoS (SYN flood) could teach about the TCP connection queue and SYN cookies

IP Spoofing can teach about the three way handshake (ACK #'s, SYN #'s) and exploiting trust relationships.

This is a solid start and all of these things can be tested in a lab. NMAP scan a test box, ARP poison two communicating machines and sniff, SYN flood some test box ON THE LOCAL NETWORK, IP spoof some box running one of the r* services, etc.

Hey Hey,

I think that a couple of things need to be decided upon before you start planning this course.

1. What user level is this based at... You mention basic knowledge of linux and tcp/ip.. but what does that really mean? Someone who's installed linux once because they heard l33t hax0rs user it??? or someone who's been using it and playing with it for 6 months - a year... TCP/IP... someone who setups up the occasional LAN for a LAN Party... or someone who has completed their Network+, CCNA, Nortel NetKnowledge, etc courses? This will play a major role... If these people are coming in with the barebones knowledge then you'll have to start a lot simpler.. but if you're focusing this course on CCNA holders that have played with linux for a couple years... the course can be a bit more advanced..

2. How intense can a 40 hour course be... Are there tests? A Final Exam... Practical Tests? My security course last semester ran 115 hours in the classroom.. and about equal hours outside the class on homework and studying... This semester is the same length... From the scheduled plans it sounds like a Continuing Education course... this means people who have been out of the classroom for a while and aren't used to learning... It also means people with lives who won't be able to do a lot of outside study... (or won't be commited to it)..

3. This is a two part.... who is this course aimed at... and how much do you value your reputation as an IT employee.... If they want a "Computer Hacking" course... it sounds like they want to aim this at High School students and COllege students... It's lose/lose before you even start... They won't work unless you give them something that's really "Underground" and then they'll just goof off.. the class is a failure before you start it... If it's a Computer Security course... are you focusing on Home User or Corporate Security... Are you focusing on IT members of the community or non-IT people... You mention a basic course.. but basic to which level of study.

If you're looking for a "Computer Hacking" course... then I think you're on track with using knoppix-std (however, I'd recommend Auditor or Whoppix since they're usually kept more up-to-date)...

However if you're looking for a Computer Security course... then it's a knowledge level thing...

Don't be worrying about "hacking" and the actual exploitation... So it' s lab-based.. this makes sense... most people learn better this way (that's why University students are tools in the real world)...

If you take your initial layout.. 5 weeks.. 4 hours (sat and sun)... Then divide the course up.... even if it is lab based, you need theory... If it's really as basic as you're making it seem... I think using a live CD is useless...because getting into nmap, nessus, etc isn't the best way to start... You need to go to the bare bones basic level..

Eg.

Week 1
Day 1
Hour 1: Introduction (What is Computer Security and WHy is it important)
Hour 2: CIA -- This is the basis for all computer security... make them understand that..
Hours 3 & 4: A very cool little lab that my security prof used last semester to introduce the basics... "Packet sniffing"

Here's how it works..
Divide the groups up into teams... we had 8 groups... 2 were Stock Brokers, 2 were banks, 2 were "Evil Hax0rs" and 2 were "Security Auditors"

1 brokerage firm and 1 bank are in a partnership... so 4 groups per side

Brokerage Firm ---- Hax0rs ---- Auditors ---- Bank

Give the brokerage firm and the bank information.. say the bank $amounts in a group of peoples accounts... and the brokerage firm $amounts that people want to buy/sell... Give them names, but not the other persons information... and then restrictions.. like they can only sell if they have $X in their bank acount...

Give the brokerage firm and the bank a few minutes to meet and discuss an "encryption scheme" soemthing simple that they can agree on... My group picked Rot13 but other groups just used stuff they made up... Then they have to transfer packets.. but they have to fill in the src, destintation, message, etc on each packet (piece of paper)... They pass it ot he group closest to them (Hax0rs or Auditors) who pass it to the opposite group and then to the recieving end... They have to successfully create all the trades in X amount of time... sending one packet at a time... and if they forget anything from the "packet" then the hax0rs or audiors can "drop it" and they only get like 10-15 econds with the packet before they have to pass it.. so they have to be quick about copying the information and following the "stream"

I can give you more details by PM if yer at all intersted.... it was a great learning experience for most of the class..

Day 2:
Hour 1: Cover yesterdays "packet sniffing lab" .. Ask hackers and audiors how they kept up... What methods they used.
Hour 2: explain real packet sniffing.. through a hub and through a switch.. .
Hour 3: Lab using Ethereal... compare what they see to what they did..
Hour 4: (if Ethereal doesn't chew this up)... Ettercap and use a switch.


Week 2:
Day 1:
Hour 1: Continue with your "packet snifffing Lab" This time the encryption.. How questions about how they decided what to do.
Hour 2: Cover Encryption -- Basics (AES-256, DES, 3DES, IDEA, etc)
Hours 3 and 4: Encryption Lab: I recommend Invisible Secrets Trial version for Windows... but you could use other software..

Day 2:
Hour 1: Last day to use your "packet sniffing lab"... This time do TCP Flags adn give a brief explanation..
Hours 2: Use Ethereal Again (reaffirm this knowledge because it's important) and this time focus on the flags... Find out how the groups guarnteed their transmission.. or if they did in the lab..
Hour 3 -4 : Break away from the lab completely and let them have some fun... Cover password policies, etc for like 30 minutes and then give them an hour and a half lab on passwords... use a windows machine to create a series of users and passwords (based on ones they supply... )... Dump the SAM file (demo how to do this) and distribute it to the students... set them forward to crack the files using john the ripper, LC5 (trial) or maybe ophcrack. Make sure you cover Brute Force, Dictionary and Rainbow Tables.

Week 3:

Day 1("Hax0ring day (half way through.. time for fun)":
Hour 1: Cover the importance of patching a system and applications...
Hour 2: Distribute copies of exploits such as the dcom or rpc exploits and have them do a lab exploiting unpatched machines to demonstrate the downfall.. Again have them sniff to see exactly what's happening
Hour 3: Cover denial of service (include prevention... aka firewall or whatever)
Hour 4: Distribute some DoS or DDoS tools and let them play with it (again make them sniff)

Day 2(Practical Test):
Hour 1: Review (in a short course, you need to do this)
Hour 2: Create a 2 hour test that covers everything you've coverd so far.. (maybe a simple war game... setup the room on hubs or switches or a little of both.. setup your PC as a webserver, and also vulnerable to some sort of exploit, Transfer a file from your PC to another and in it have the name of an exploit that it's vulnerable to... and a password for the website on the server, seperate files).... See how many of them can sniff the data (using the correct tool)... determine your machines address and then access the website and upload (using a simple php upload script hat you have running) the sourcecode for the proper exploit (named <their name>.c)
Hour 4: Let them run a little late if needed and then wrap up by covering the lab and which parts they found difficult.

Week 4:
Time for some port scanning..

Day 1:

Hour 1: Cover TCP Ports (Common Ports, Well Known Ports, Ephemeral Ports) and the basics of a TCP Connect scan and a Syn scan
Hour 2: Pull out nmap and setup some machines for them to scan... have a few different devices so they can see OS detection.. maybe a router or managed switch, a windows machine and a linux machine
Hours 3 & 4: Change the pass and cover physical security... show a scene out of a movie (such as T2) that's got a short section that demos plenty of physical security. the lab can be identifying the types of physical security in place.. and then explain and cover them.

Day 2:

Hour 1: Explain Security Auditing
Hour 2: Run a short intro to nessus...
Hour 3-4: Setup another mini wargame.. have them run a nessus scan against a vulnerable machine (something that nessus will find)... give them a list of online exploit repositories.. and let them find the correct exploit

Week 5:

Day 1:
Hour 1: Cover Protection more in depth... File system security, Firewalls (hardware and software), iDS
Hour 2: Walk them through writing some Iptables/ipchains rules (use their thus gained TCP/IP knowledge to hepl them and to reaffirm it)
Hour 3: Setup an IDS (snort perhaps) with them
Hour 4: Have them generate some traffic and sniff it.. compare the ethereal/ettercap results with the snort messages and watch the difference between traffic with the firewall down adn the firewall up.

Day 2:
Hour 1: Finish up your analysis from last week
Hour 2 (have some more fun): teach them the basics of mySQL and PHP and cover some basic injection
Hour 3-4: bring up wireless... maybe demo wepcrack
Final: Wrap everything up.. leave them with some resources to continue their learning (AO, WebGoat, Hacme Bank, SecurityForest, SecurityFocus, Secunia, PacketStorm, Shmoo, K-Otik (FrSIRT), milw0rm, etc)

Anyways.. It's 4:30 AM and apparently Ijust spent an hour typing that.. but that's how I'd design it... I think had my first security been structured more like that. a lot of the students would have come out a little better off (then again.. some learned a lot)

Take what ya want and burn the rest :P

Peace,
HT