Teaching offensive security (ethical hacking) is becoming a necessary component of information security curricula with a goal of developing better security professionals. The offensive security components extend curricula beyond system defense strategies. This paper identifies and discusses the learning outcomes achieved as a result of hands-on lab exercises which focus on attacking systems. The paper includes the ethical implications associated with including such labs. The discussion is informed by analyses of log data on student malicious activities, and student survey results. The examination of student behavior after acquiring these skills demonstrates that there is potentially a high risk of inappropriate and illegal behavior associated with this type learning. While acknowledging these risks and problems, the paper recommends that curricula should opt for a teaching approach that offers students both offensive and defensive hands-on lab exercises in conjunction with lecture material. The authors propose steps to minimize the risk of inappropriate behavior and reduce institutional liability.

No abstract

No abstract

This chapter identifies and discusses the learning outcomes to be achieved because of hands-on lab exercises using ethical hacking. It discusses the ethical implications associated with including such labs in the information security curriculum. The discussion is informed by analyses of log data on student malicious activities, and the results of student surveys. The examination of student behavior after acquiring handson offensive skills shows that there is potentially a high risk of using these skills in an inappropriate and illegal manner. While acknowledging the risk and the ethical problems associated with teaching ethical hacking, it strongly recommends that information security curricula should opt for a teaching approach that offers students both offensive hands-on lab exercises coupled with ethical practices related to the techniques. The authors propose steps to offer a comprehensive information security program while at the same time minimizing the risk of inappropriate student behavior and reducing institutional liability in that respect and increasing the ethical views and practices related to ethical hacking.

An Ethical Hacking (EH) course not only is a critical component for a Cybersecurity program but also an essential preparation for CS/IT majors towards career paths as security professionals. We face two major challenges when developing an undergraduate EH course, including the setup and choice of the lab design, and the choice and organization of covered topics for this course. On one hand, we have limited space, budget and technical support for a course that relies heavily on hands-on exercises. Given the nature of this course, the lab activities are often "offensive" and lab operations demand administrative privileges, which cause compliance issues with the university's IT policies. On the other hand, given the vast variety of topics and the fast pace of the field, it is difficult to select and organize an essential set of knowledge units to ensure that students are exposed to current technologies and prepared to be industry-ready. We adopt two major design principles to address these challenges correspondingly. First, our choice of a hybrid Virtual Machine (VM)-based and Web-based labs provides students the full set of privileges to perform lab activities without posing threats to the campus network. The Web-based labs remove high cost of hardware and avoid overwhelming installations and configurations for the lab. Second, given the diversity of topics and fast developments in this field, we choose topics based on four criteria: representative, current, certification-related, and foundations for other covered concepts. The chosen topics are aligned with three EH certificates, and organized into twelve modules with clear intermodule and intra-module logic. This paper details the curriculum of this EH course and elaborates how our design principles are entailed in the course.