Session F1D Network Security Focus on Security, Skills, and Stability

Abstract- Computer network security is a new and fast moving technology in the field of computer science. As such, the teaching of security is still a moving target. Security courses originally focused on mathematical and algorithmic aspects such as encryp

Network Security: Focus on Security, Skills, and

Stability

Susan J Lincke

University of Wisconsin-Parkside Kenosha, WI, susan@lincke.org

Andrew Holland

University of Wisconsin-Parkside Kenosha, WI, syclops@ehollands.net

Abstract - Computer network security is a new and fast moving technology in the field of computer science. As such, the teaching of security is still a moving target. Security courses originally focused on mathematical and algorithmic aspects such as encryption and hashing techniques. However, as crackers hacked away at networks and systems, courses arose that emphasized the latest attacks. These attacks soon became out-of-date with security software responses. As security technology continues to mature, there is an emerging set of security techniques and skills. Network security skills emphasize business practices, legal foundations, attack recognition, security architecture, and network optimization. These skills tend to stabilize network security course(s). This paper summarizes skills relating to network security, and discusses active-learning exercises that assist students in learning these important skills.

Index Terms - Security, Audit, Service Learning.

INTRODUCTION

Computer and network security is a new and fast moving technology and as such, is still being defined. When considering the desired learning outcomes of such a course, one could argue that a network security analyst must be capable of analyzing security from the business perspective in order to adhere to recent security legislation, and from the technical perspective in order to understand and select the most appropriate security solution. The analyst must be able to use security tools – but also apply the results to his or her organization. The analyst must be able to configure routers, firewalls, and an intrusion detection system (IDS) – but in an efficient and effective way. This partial list of skills improves security course stability and effectiveness. This paper investigates an outcome-based network security course emphasizing skill-development.

Network security originally focused on algorithmic aspects such as encryption and hashing techniques. While these concepts rarely change, these skills alone are insufficient to protect computer networks. As crackers hacked away at networks and systems, courses arose that emphasized the latest attacks. Currently, many educators believe that to train people to secure networks, they must also learn to think like a cracker [1-2]. However, Logan and Clarkson argue that teaching attack techniques is dangerous because it may lead to criminal behavior, takes course time

away from important security techniques, and may fail debates during the Security course approval process [3]. However, additional reasons (learned from experience) is that 1) countering hacks results in lectures can become facts-based (e.g. identifying Microsoft vulnerable ports) instead of skills-based, leading to boring lectures; and 2) hacks become nearly irrelevant as soon as security software is enhanced to counteract the hack. Thus, an emphasis on hacking techniques can result in continual changes in the course material that often becomes out-of-date with the next minor/major OS or other software release.

An example is the Microsoft Windows null user, who used to have access to information about users, password restrictions, share availability, etc. The null user did not require a login ID or password [4]. Since Microsoft has fixed this vulnerability, this hacking lab is now outdated (assuming patches are applied or a new OS version is in use).

A second example is that traditional stages of hacking include Reconnaissance, Scanning, Gaining Access, and Exploit [2, 4]. With modern security techniques, including fortified border routers, firewalls and IDSs, the Scanning and Enumeration stages are mostly ineffective on a secured network. Instead, in 2006, virus/worms (usually emailed) were most frequently encountered and caused the largest financial losses of any attack type [5]. Optionally, direct web hacks, which bypass the early stages of hacking, may now offer a speedier, successful attack.

As security technology continues to mature, there is emerging a sophisticated set of security techniques and skills. Although students enjoy and learn from the labs, they have problems applying audit tool results to real-world problems within the required community-based project. Thus, security lectures and labs must help students to think or apply material, instead of memorizing fact after fact. A detailed statement of intended learning outcomes is necessary to define specific skills that enable students to be more effective in applying security techniques to real-world problems.

An undergraduate network security course is preferably widely applicable to any company. In today’s world, companies expect employees to use existing packages for efficiency. Emphasizing security tools moves the course from a Computer Science (CS) focus into an Information Systems or Information Technology focus. However, it enables a broader set of security concepts and skills to be taught in a shorter time. Programmers can benefit when selecting and integrating security packages into application software;