Network reconnaissance, attack, and defense laboratories for an introductory cyber-security course

Cyber security is an area where much curriculum development is taking place, and it is important that such efforts be shared. In this work we describe three lab exercises developed at the United States Naval Academy for use in our fundamentals of cyber-security course, a course required of all freshmen. The hands-on lab activities reinforce ideas presented in classroom discussions about basic network reconnaissance, attack, and defense. A class of approximately twenty students is divided into two teams. Each team's network has its own workstation, name server, and gateway router, and a webserver. Students each have an individual host machine on their own network. In the reconnaissance lab students attempt to discover the opponent network's topology, services and software, as well as guess account names and potential passwords. The information is then used in the succeeding attack lab, where denial of service attacks, injection attacks, and other remote exploits are conducted. During the defense lab, students harden their systems by managing accounts and passwords in both Unix and Windows systems, encrypting confidential files, defending against HTML injection attacks, configuring a firewall, shutting down unnecessary services, removing unnecessary software, and patching known vulnerabilities; all while maintaining a prescribed set of services. All three labs are conducted using virtual machines (VMs) in a virtual. Detailed instructor notes, lab instructions, student check sheets, grading sheets, and supporting software were developed for these labs. In this paper we discuss our experiences with these labs, assessment and evaluation material, and lessons learned. The insights that we have gained will prove useful to those thinking about implementing or refining labs in a cyber-security course, or perhaps even for other types of labs.