A Remotely Controlled And Isolated Computer Network Test Bed For Attack Understanding Based Information Assurance Distance Education Courses
Philip Lunsford, Lee W. Toderick, Daniel Brooker · 2020
Information assurance (IA) education has become an important topic in information technology related curriculums.Within the culture of IA educators, there are two pedagogical strategies: defense assurance and attack understanding.Defense assurance focuses on appropriate ways to build and maintain systems that are less vulnerable to attack.Attack understanding focuses on strategies for attacking and how to defend against them.Curriculums that focus more on attack understanding can use isolated test beds to provide laboratory experiences for the students to attack and defend networks.In a face-to-face environment, the test bed isolation can be accomplished by excluding wireless, infrared, and EoP (Ethernet over Power) interfaces, disabling any removable media, and by having only power cables (i.e.no network cables) extend beyond the test bed.Unfortunately, the use of air-gap isolation is unsuitable in a distance education (DE) environment.Remote students must control equipment in the test bed and therefore must have some sort of access.Computer and networking equipment laboratories are provided in some defense-assurance-focused DE courses, but the access methodology is usually designed to only prevent external access by unauthorized machines.This can be accomplished by using a VPN concentrator or other access firewall.In the case of attackunderstanding-based laboratories, the access methodologies employed must guarantee the prevention of any attack escaping the confines of the test bed.Take the example of a demonstration of worm propagation via email attachments.The attacking machine sends an email to the victim machine that has a worm attached as an executable file.As part of the lab exercise the victim machine executes the file, installing the worm on the victim machine.The attacking machine then gains access to some resource on the victim machine.In a DE environment, the educator is responsible for ensuring that the worm cannot escape the isolated environment.This paper discusses secure student access and network isolation techniques for DE network test beds and proposes the use of IP-based KVM switches as a mechanism for guaranteeing test bed isolation while maintaining remote access for the students.Tradeoffs of cost, capability, maintainability, and degree of isolation are also discussed.