Using Virtualization to Create and Deploy Computer Security Lab Exercises

Abstract

Providing computer security laboratory exercises enables students to experience and understand the underlying concepts associated with computer security, but there are many impediments to the creation of realistic exercises of this type. Virtualization provides a mechanism for creating and deploying authentic computer security laboratory experiences for students while minimizing the associated configuration time and reducing the associated hardware requirements. This paper provides a justification for using virtualization to create and deploy computer security lab exercises by presenting and discussing examples of applied lab exercises that have been successfully used at two leading computer security programs. The application of virtualization mitigates many of the challenges encountered in using traditional computer laboratory environments for information assurance educational scenarios.

A SWOT Analysis of Virtual Laboratories for Security Education

“…Several similar projects to utilise virtualisation for diverse ICT security learning environments have been documented [3,4,5,6,7,8,9,10]. Such experiments are encouraging, yet when it comes to implementing our own virtual version of a laboratory we find that there are several general questions that we can identify and that we hope to address: -Pedagogy.…”

“…It is common to specify the number of machines that the software is to be installed upon. With easily copyable virtual environments it becomes far more difficult to calculate and control the number of machines that the software is installed upon, and it is a problem that current licenses specify limits on such numbers [4]. It would surely make better sense to have licenses that stipulate the number of copies that may be used concurrently [12].…”

Creating Shareable Security Modules

“…As an example of this process, we rewrote a lab exercise (described in [9]) instrumented in a RAVE cluster to follow the SI@T model. The module was originally written to permit other faculty to adopt the module for use in their own institutions.…”

Setting up a low-cost lab management system for a multi-purpose computing laboratory using virtualisation technology

“…Over the past few years, hands on exercises using VMs have been tried successfully in courses related to information, web or computational security (Tao, Chen & Lin, 2010;Gephart & Kuperman, 2010;Hay, Dodge & Nance, 2008;Hickman, 2008;Bullers, Burd & Seazzu, 2006;Adams & Laverell, 2005), operating systems (Nieh & Vaill, 2005;Adams & Laverell, 2005), Windows and Linux system administration (Hickman, 2008;Stackpole et al, 2008), database (Cranitch & Rees, 2009), computer forensics (Hickman, 2008;Bullers, Burd & Seazzu, 2006), data communications (Hickman, 2008) and networking (Stackpole et al, 2008;Bullers, Burd & Seazzu, 2006;Adams & Laverell, 2005;Armitage & Harrop, 2005). Most of these publications describe case studies of the use of VMs in specific IT courses and focus on the content of the exercises and how the lessons were conducted.…”