Syllabus: IST451. Division of Business and Engineering. Penn State Altoona

Transcription

1 Syllabus: IST451 Division of Business and Engineering Penn State Altoona Course Title 1. IST451: Network Security-Spring Section Credits: 3 Meeting Times 1. Lectures: Mondays and Wednesdays 9:25 AM to 10:40 AM 2. Labs: Fridays 9:25 AM to 10:40 AM Instructor Professor Jungwoo Ryoo, Ph.D., CISSP Office: 147 LRC (library building: Eiche) jryoo@psu.edu WWW: Phone:

2 Office Hours At Dr. Ryoo s o ce (and by appointments) Mondays and Wednesdays: 2:00 to 4:00 PM Course Homepage Angel ( Prerequisites 1. IST 220: Networking and Telecommunications Required Texts 1. Raymond Panko, Corporate Computer and Network Security, 2nd edition, Prentice Hall, 2009 (ISBN: ). 2. Eric Seagren, Secure Your Network for Free, 1st edition, Syngress, 2007 (ISBN: ). Course Description IST 451 is an introductory class on network security. This course provides the students with a comprehensive understanding of the fundamental issues and concepts of network security, and the mainstream network security technologies and protocols that are widely used in the real world.

3 Course Objectives Upon completion of this course, students will be able to: 1. Understand the fundamental concepts and issues of network security, 2. Understand the mainstream network security technologies and protocols, 3. Understand how real-world networks are attacked, and 4. Be able to apply network security knowledge to defend against a set of widely known network attacks. Tentative Schedue This schedule is subject to change and available at: id=1e_lwryx30uxc1ngqnydnpezgpvgfbq1lbrednlp1smq Grading Policy Grade Distribution 1. Participation: 10% (pop quizzes) 2. Labs: 20% 3. Term project: 10% 4. Midterm I: 20% 5. Midterm II: 20% 6. Final: 20% Grading Scale 1. A: 93% to 100% 2. A-: 90% to 92.9% 3. B+: 87% to 89.9% 4. B: 83% to 86.9% 5. B-: 80% to 82.9% 6. C+: 77% to 79.9% 7. C: 70% to 76.9% 8. D: 60% to 69.9% 9. F: less than 60% Course Format In a real-life work environment, problem solving and troubleshooting skills are becoming ever more important. Even more sought after is an ability to quickly gain new knowledge and apply it in the process. The format of this course is deliberately designed to help students acquire these

4 skills throughout the semester. At the beginning of each class, students will be given a coherent set of problems and learning objectives relevant to these problems (5 minutes). All the information necessary to solve the problems will be provided during the lecture (30 minutes). Students then work on a hands-on exercise (35 minutes) and a quiz (5 minute) based on the problems posed earlier in the class. Term Important Dates 1. Drop Deadline: January 18th 2. Add Deadline: January 19th 8 AM 3. Withdrawal Deadline: April 27th 4. Midterm Exam One: January 30th 5. Midterm Exam Two: March 2th 6. Final Exam: May 2nd (Wednesday) at 8:00 AM (259 Hawthorn) Attendance Students are expected to attend every class and encouraged to actively participate in class activities. Make-up Examinations Students are expected to attend every class and encouraged to actively participate in class activities. Classroom Etiquette In general, students are expected to behave in a way that does not hinder other students' learning. For example, students are expected to turn off their cellular phones before each class. Cellular phones must be put away during the midterm and final exams. Assignment Submission and Deadline Policies Homework assignments must be submitted by the designated due date. Students are recommended to type their homework and to use electronic submission (Angel). A drop box will be created for each assignment. Handwritten homework will not be considered if not legible. Late assignments are assessed with a ten percent per-day late penalty, up to a maximum of four days. Unless the problem is apocalyptic, don't give excuses. Students with legitimate reasons who contact the professor before the deadline may apply for an extension.

5 Communication Policies The instructor prefers s to phone calls. He checks his regularly. Therefore, sending an is the best way to contact your instructor. Penn State University s Academic Integrity Policy Academic Integrity Definition and Expectations: Academic integrity is the pursuit of scholarly activity in an open, honest and responsible manner. Academic integrity is a basic guiding principle for all academic activity at The Pennsylvania State University, and all members of the University community are expected to act in accordance with this principle. Consistent with this expectation, the University's Code of Conduct states that all students should act with personal integrity, respect other students' dignity, rights and property, and help create and maintain an environment in which all can succeed through the fruits of their efforts. Academic integrity includes a commitment not to engage in or tolerate acts of falsification, misrepresentation or deception. Such acts of dishonesty violate the fundamental ethical principles of the University community and compromise the worth of work completed by others. (Policies and Rules for Students, Section ) Consequences of academic dishonesty: The instructor may assign an academic sanction ranging from a warning, to failure on an assignment or in the course, or to removal from the course. (Note that a failure in a course may affect a student's status in a program and/or in the University.) The instructor reports each academic sanction to the Office of Judicial Affairs, which keeps a record. Students can appeal academic sanctions to the Committee on Academic Integrity through the Office of Academic Affairs. In more serious cases of academic dishonesty, the Office of Judicial Affairs may apply disciplinary sanctions in addition to the academic sanctions. These may range from a warning to probation, suspension or expulsion from the University. An XF grade is a formal University disciplinary sanction that indicates on the student's academic transcript that failure in a course was due to a serious act of academic dishonesty. (Policies and Rules for Students, Section 49-20, and Academic Integrity Procedure G-9.) While students can help each other (no more than three people in a group) with their homework assignments, they are still expected to do their own work individually. Copying someone else's work is not permitted at all. Note that the instructor checks the similarities to ensure the originality of the work. Statement on Accessibility If you have a documented disability which requires classroom accommodations, please notify the instructor. All students with disabilities are required to register with the Office for Disability Services on campus for the provisions of appropriate accommodations. Disability Services is located in the Health and Wellness Center,

6 IST 451 Tentative Schedule 2012 Date Week Session Lecture Topics Chapter Homework Due 1/9 1 (M) 1 Host and Data Security Panko 7 1/11 1 (W) 2 Host and Data Security Panko 7 1/13 1 (F) 3 Host and Data Security Panko 7 Lab One 1/16 2 (M) 4 Host and Data Security Panko 7 1/18 2 (W) 5 Host and Data Security Panko 7 1/20 2 (F) 6 Application Security Panko 8 Lab Two 1/23 3 (M) 7 Application Security Panko 8 1/25 3 (W) 8 Application Security Panko 8 1/27 3 (F) 9 Application Security Panko 8 Lab Three 1/30 4 (M) 10 Midterm Exam One 2/1 4 (W) 11 Protecting Your Perimeter Seagren 2 2/3 4 (F) 12 Protecting Your Perimeter Seagren 2 Lab Four 2/6 5 (M) 13 Protecting Your Perimeter Seagren 2 2/8 5 (W) 14 Protecting Your Perimeter Seagren 2 2/10 5 (F) 15 Protecting Your Perimeter Seagren 2 Lab Five 2/13 6 (M) 16 Protecting Your Perimeter Seagren 2 2/15 6 (W) 17 Configuring an IDS Seagren 4 2/17 6 (F) 18 Configuring an IDS Seagren 4 Lab Six 2/20 7 (M) 19 Configuring an IDS Seagren 4 2/22 7 (W) 20 Configuring an IDS Seagren 4 2/24 7 (F) 21 Testing and Auditing Your Systems Seagren 6 Lab Seven 2/27 8 (M) 22 Testing and Auditing Your Seagren 6

7 Systems 2/29 8 (W) 23 Testing and Auditing Your Systems Seagren 6 3/2 8 (F) 24 Midterm Exam Two Lab Eight 3/5 N/A N/A Spring Break N/A N/A 3/7 N/A N/A Spring Break N/A N/A 3/9 N/A N/A Spring Break N/A N/A 3/12 9 (M) 25 Managing Event Logs Seagren 5 3/14 9 (W) 26 Managing Event Logs Seagren 5 3/16 9 (F) 27 Managing Event Logs Seagren 5 Lab Nine 3/19 10 (M) 28 Protecting Network Resources Seagren 3 3/21 10 (W) 29 Protecting Network Resources Seagren 3 3/23 10 (F) 30 Protecting Network Resources Seagren 3 Lab Ten 3/26 11 (M) 31 Protecting Network Resources Seagren 3 3/28 11 (W) 32 Protecting Network Resources Seagren 3 3/30 11 (F) 33 Protecting Network Resources Seagren 3 Lab Eleven 4/2 12 (M) 34 Network Reporting and 4/4 12 (W) 35 Network Reporting and 4/6 12 (F) 36 Network Reporting and 4/9 13 (M) 37 Network Reporting and 4/11 13 (W) 38 Network Reporting and 4/13 13 (F) 39 Network Reporting and Lab Twelve Lab Thirteen 4/16 14 (M) 40 Pen Testing Semester 4/18 14 (W) 41 Pen Testing Semester

8 4/20 14 (F) 42 Pen Testing Semester 4/23 15 (M) 43 Pen Testing Semester 4/25 15 (W) 44 Pen Testing Semester 4/27 15 (F) 45 Pen Testing Semester Report

9 IST 451 Term Description During this term project, your team shall design and implement a secure network, and allow other teams to conduct pen testing against your network. Phase One: Design Requirements You shall develop a design for your secure Local Area Network (LAN) including Topology IP addresses Roles each device play Virtual machines Two routers with both internal and external NICs Four hosts Windows 7 host (equipped with a host firewall) Fedora host (equipped with a host firewall) Proxy server (Ubuntu) Web server (IIS on Windows 2008 R2) Software Ubuntu Linux Fedora Linux Web server one (use the latest version of Apache for this) Web server two (use the latest version of IIS for this) Proxy server (pick your own) Host firewall (pick your own) Sniffer (use the latest version of WireShark) IDS (use the latest version of Snort with BASE) Log monitoring system (use the latest version of OSSEC or SWATCH) Things to be included in your report Your network topology in a Visio diagram (you can use different software to draw the diagram if you would like) List The names of Open Source Software (OSS) you are using Online documentation to be used for the OSS products Brief description and justification of how and where you would like to install the software and virtual hardware in the topology Grading will be based on whether you satisfy all the aforementioned requirements. Report (minimum 1,500 words) due on 2/20/2012 Phase Two: Implementation

10 Start date: 2/21/2012 Report (minimum 1,500 words) due on: 4/16/2012 Implement your design using the virtual machines provided by the instructor. The grading rubric is available at id=dsbrgsv_248cppbcvd9. Phase Three: Pen Testing Start date: 4/16/2012 End date: 4/29/2012 Your team must pick another team for a pen testing candidate. Each team tests the other teams' security readiness by launching security attacks and compiles a pen test report (minimum 1,500 words) for their opponent team. Based on: the number of successful attacks and defenses and the thoroughness of the pen testing report, the instructor evaluates each team and assigns a grade.