Last modified: Wednesday, April 26, 2006
Network security training --
When the 'good guys' get to play 'bad guys'
FOR IMMEDIATE RELEASE
April 27, 2006
BLOOMINGTON, Ind. -- Researchers at Indiana University's Advanced Network Management Lab (ANML), part of Pervasive Technology Labs, have developed a hands-on training exercise that allows network and security professionals from colleges and universities to play the role of network intruder on a simulated "real-world" network. "War Games: An Exercise in Ethical Cracking" was designed with the higher education security community in mind.
"The aim of the training is to give participants hands-on experience using the kinds of tools and techniques that bad guys use and to give them better insight into the practicalities of computer and network security," said ANML researcher and training co-facilitator David Ripley.
"There are many people who set policy or who are directly involved in the practical aspects of computer security who -- despite being highly knowledgeable in their field -- might not have any experience of how a real-world 'cracker' goes about breaking into a computer system," he said.
Ripley notes that this type of hands-on cracking exercise is not typically offered at venues catering specifically to the higher-education community, and he believes the format gives participants new insights that will help them to better protect their own networks.
"We're exposing people who might not otherwise have the opportunity to participate in these kinds of exercises" said Ripley.
In the exercise, a single physical machine running specialized software acts as multiple virtual hosts. Groups of participants are given the goal to "capture" as many of the other groups' hosts as possible during an allotted time.
The groups receive credentials to log into an isolated network segment and are provided a set of tools that helps them to elevate their privileges or "gain root" on their own machine. "Gaining root" means the groups secure access to areas of the operating system typically only available to the administrators of a shared computer.
This in turn allows the groups to reach a larger set of tools with which they can obtain entry to other groups' machines and work to gain root on those machines. Throughout the exercise each group monitors for outside attacks from their competitors and attempts to defend against them.
"War Games" training was most recently offered at the Security 2006: Educause & Internet2 Security Professionals Conference held in Denver, Colorado, April 10-12. Security 2006 marks the fourth time the ANML has offered this type of hands-on exercise to groups of network security professionals and feedback from participants has been positive.
"People learn best by doing things for themselves," said Ripley.
The group plans to offer "War Games" training at future events like those sponsored by Educause and Internet2 in an ongoing effort to reach the higher education security community.
About Pervasive Technology Labs at Indiana University
Pervasive Technology Labs at Indiana University (pervasive.iu.edu), established in 1999 by a grant from Lilly Endowment, Inc., performs leading-edge research based on the ubiquity of information technology in today's world, creating new inventions, devices, and software that extend the capabilities of information technology in advanced research and everyday life.
Fundamental to its mission are efforts to attract, encourage, educate, and retain Indiana 's workforce of tomorrow, and to accelerate economic growth in the State through the commercialization of new inventions and by forming and supporting new start-up companies. In carrying out its mission, Pervasive Technology Labs is helping Indiana University maintain its position of international leadership in information technology research and, as a result, is helping to enhance the prosperity of the entire state of Indiana.
