Developing and delivering hands-on information assurance exercises: experiences with the cyber defense lab at UMBC

Abstract

In summer 2003, we developed four new hands-on information assurance educational exercises for use in the UMBC undergraduate and graduate curricula. Exercise topics comprise buffer overflow attacks, vulnerability scanning, password security and policy, and flaws in the Wired Equivalent Privacy (WEP) protocol. During each exercise, each student carries out structured activities using a laptop from a mobile cart that can be rolled into any classroom. These dedicated, isolated machines permit a student to make mistakes safely, even while acting as the system administrator, without adversely affecting any other user. Each exercise is organized in a modular fashion to facilitate varied use for different courses, levels, and available time. Our experiences delivering these exercises show that practical hands-on activities motivate students and enhance learning. In this paper we describe our exercises and share lessons learned, including the importance of careful planning, ethical considerations, the rapid obsolescence of tools, and the difficulty of including exercises in already busy courses.

SAKGP: Secure Authentication Key Generation Protocol in WLAN

“…Liu et al [10] have illustrated an overview of WPA / WPA2 vulnerabilities and current researches in the method of attacks in WPA/WPA2 are described. Sherman et al [11] have developed for the UMBC Cyber Defense Lab cover a variety of important and timely IA topics. The author has performed vulnerability monitoring exercise in the real-time test bed and has received overwhelmingly positive reactions from students, who appreciated the practical, hands-on learning activities related to a useful and interesting topic.…”