1,576
edits
Changes
m
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.ppt ppt] ] Course Intro / The "Security Mind"
:'''Resources:'''
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520 SEC520 WIKI]
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
::* [https://cs.senecac.on.ca/~scs/DonMillsPolicies/policy.html Course Policies]
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520#Supplies_Checklist_.28Required_for_Second_Class.29 Required Materials]
:'''Lab 1:'''
::Set-Up for Labs:
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_1.html Setup Hard Disk Pack for Labs]
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.ppt ppt] ] Vulnerability Testing::* [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.odp odp] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.pdf pdf] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.ppt ppt] ] Interpreting and Respecting the Rules for the Tank Server
::*[http://www.commonexploits.com/?p=243 Using Armitage] (Metasploit Framework)
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
|:'''Reading References:'''::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 3)
:'''Week 4'''
|:'''Resources:'''
|- valign="top"
:'''Week 5'''
|:'''Lab 4:''':Attack Categories:::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Types of Attacks]
:'''System Hardening in Linux:'''
::*Purpose
::*Rule of Preventative Action
::*Rule of Separation
::*Rule of Least Privilege
:::*AAA Protocol (Authentication):
::::*PKI
::::*PAM
::::*Kerebos
|
:'''Slides (Concepts):'''
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.ppt ppt] ] Linux Hardening (part 1)
:'''Reading References:'''|- valign="top"::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook (E-book)]<br />(Chapter 4 - Pages: )|
:'''YouTube Videos:'''
::*Linux Hardening
:::[http://www.youtube.com/watch?v=GJMKgV8V4FI Part1] | [http://www.youtube.com/watch?v=M9LdGH_AIZo Part 2] | [http://www.youtube.com/watch?v=0tEBXWU6Au4 Part 3]
::*[http://www.youtube.com/watch?v=yy1NR74ttAw&feature=results_main&playnext=1&list=PL48E055817B95897B PAM]
:'''Assignment #1 Posted:'''
::* [https://scs.senecac.on.ca/~fac/sec520/assignments/SEC520_Assignment_1.html Assignment Submission Instructions]
|- valign="top"
:'''Week 6'''
|:'''Slides (Concepts):'''
|
|- valign="center"
!colspan="4"|'''Study Week'''
|
:'''System Hardening in Linux / Continued:'''
::*AAA Protocol (Authorization):
:::*ACLs
:::*SELinux
:::*Sudo
:::*Cron Jobs
:::*Turning Off Xwindows
:'''Hardening Windows 2003 Server:'''
::*Installing and Configuring Security Configuration Wizard
::*Using New Technology File System (NTSF)
::*Configuring Automatic Updates
:'''YouTube Videos:'''::*[http://www.youtube.com/watch?v=6piQXXHTmqk ACLs]::*[http://www.youtube.com/watch?v=fpXuWhshKVA SELinux]::*[http://www.youtube.com/watch?v=imnEUvvDxc4 Sudo]::*[http://www.youtube.com/watch?v=4Icg3MYZZqI Cron Jobs] :'''Reading References:'''::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 5 - Pages: )::*[http://lcweb.senecac.on.ca:2063/0131963694?uicode=seneca SELinux by Example]<br />(Chapter x - Pages: )|
:'''Resources:'''
::* [http://www.linuxquestions.org/linux/answers/security/acls_extended_filepermissions How to Use ACLs]
::* SELinux
::* [http://www.sudo.ws/sudo/intro.html Sudo In a Nutshell]
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1.ppt ppt] ] Hardening Windows
:'''Reading References:'''::* [http://lcweb.senecac.on.ca:2052/toc.aspx?site=RYW9D&bookid=12602 Hardening Windows, 2nd Edition]<br />(Chapter 5 - Pages: )|
:'''YouTube Videos:'''
::*[http://www.youtube.com/watch?v=df1_yx2fa8g Security Configuration Wizard 2003]
:'''Lab 5:'''
::System Hardening
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_5.html Linux System Hardening (part 2)]
:'''Lab 7:'''
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_7.html Hardening Windows 2003 Server]
:'''Intrusion Detection:'''
::*Purpose
::*Logs
::*Monitoring
::*Iptables
::*Using Tripwire
:'''YouTube Videos:'''
::*[http://www.youtube.com/watch?v=ZUygX8TBBw0 Phishing]
::*[http://www.youtube.com/watch?v=PqfZM3Lxrmg Malicious Payload]
::*[http://www.youtube.com/watch?v=-hd7XG-b6uk IP Spoofing]
::*[http://www.youtube.com/watch?v=AhTfo6pWBIM Database Injection]
::*[http://www.youtube.com/watch?v=Iyh_w0Ix2bc Password Cracking]
:'''Reading References:'''
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapters 4,5,6)
:'''Resources:'''
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
:'''Reading References:'''
::*[http://www.sans.org/score/checklists/ID_Linux.pdf Intrusion Discovery - Linux]
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 1 - Pages: )
:'''Additional Resources (for interest):'''
::*[http://www.sans.org/score/checklists/ID_Windows.pdf Intrusion Discovery - Windows]
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
</div>
:'''Lab 8:'''
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_8.html Intrusion Detection]
:'''Assignment #2 Posted:'''
::*Details - N/A
|- valign="top"
|
:'''Week 10'''
:'''Slides:'''
::* <div style="background:#ffff00">[odp] [pdf] [ppt] Additional Considerations</div>
:'''Reading References:'''::*|- valign="top"|:'''YouTube Videos:Week 11'''::*
:'''Resources:'''
::*
|- valign="top"
:'''Week 11'''
|
:'''Test #2:'''
::*Test Details
<!-- * SELinux and httpd -->|:'''Lab 8:'''
Protected "SEC520 Weekly Schedule": OER transfer ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))
[[Category:SEC520]]
=SEC520 Weekly Schedule=
== Winter 2018==
::Instructor:<br />Austin (SAA)<br />Craig Barretto (craig.barretto@senecacollege.ca)
1 credit
::*Quiz and Labs ( 4 Quiz, 7 Labs (15%))
::::'''Logbooks due April 10th, 2018'''
::*Assignments (2) 20%
::::'''Assignment 1 - Due Date March 9''''''
::::'''Assignment 2 - Due Date TBA''''''
::*Tests (2) 30%
::::'''Written Test - March 8''''''
::::'''Lab Test - March 15'''''
::*Final Test 35%
{|width="100%" border="1" cellspacing="2"
| style="width: 10%;" |
|- valign="top"
|
:'''Week 1'''
::* Required Materials
::* Lab Setup
|
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l1.ppt ppt] ] Course Intro / The "Security Mind"
:'''Reading References:'''
::* [http://lcweb.senecac.on.ca:2053/0596006691 Computer Security Basics (E-book)]<br />(Chapter 1: The New Insecurity)
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=86056&recCount=50&recPointer=0&bibId=263746 Inside the Security Mind, Making the Tough Decisions (E-Book)] (Chapters 1 - 3)
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 2: Reconnaissance)
:'''Resources:'''
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520 SEC520 WIKI]
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
::* Required Materials are listed in your Supplies Checklist. Other materials and references are noted week by week.
|
:'''Lab 1:'''
::Set-Up for Labs:
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_1.html Setup Hard Disk Pack for Labs]
|- valign="top"
|
:'''Week 2'''
|
::::*User Information
::::*Verification
|
:'''Slides (Concepts):'''
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w1_l2.ppt ppt] ] Penetration Testing: Reconnaissance
::*[http://www.youtube.com/watch?v=NDQffaAMLQc Reconnaissance]
|
:'''Lab 2:'''
::Pentration Testing:
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_2.html Reconnaissance]
|- valign="top"
|
:'''Week 23'''
|
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l1.ppt ppt] ] Scanning & Enumeration
:'''Reading References:'''
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Scanning 1] , [http://www.youtube.com/watch?v=WKLNAAt57Wg Scanning 2]
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Enumeration]
::*[https://www.youtubepentest-tools.com/watch?v=FMgAIfcPsyw Vulnerability Testing network-vulnerability- Overview]::*[https:scanning//www.youtube.com/watch?v=lNjxwvQTtcp-port-scanner-online-nmap Online Pen-os NessusTest Scanner]::*[https://www.youtube.com/watch?v=hRxOW37MRwc Accessing System Via dR7NTYfmNcA Prep for Metasploit (web-browser)]
:'''Resources:'''
::*[http://nmap.org/book/man.html Nmap Reference Guide]<br />(How to use '''nmap''' utility to scan ports)
|
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
</div>
|- valign="top"
|
:'''Week 34'''
|
:'''Scanning, Enumeration, & Vulnerability Testing:'''
::*Vulnerability Testing
|
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.ppt ppt] ] Vulnerability Testing
:'''YouTube Videos:'''
::*[https://www.youtube.com/watch?v=FMgAIfcPsyw Vulnerability Testing - Overview]
::*[https://www.youtube.com/watch?v=lNjxwvQT-os Nessus]
::*[https://www.youtube.com/watch?v=hRxOW37MRwc Accessing System Via Metasploit (web-browser)]
:'''Resources:'''
::*[https://www.youtube.com/watch?v=r4Qq2eVjiP0 Setting up the Metasploit database]
::*[https://www.youtube.com/watch?v=x01ZErjNlX0 First Metasploit Payload]
::*[http://www.youtube.com/watch?v=jJd5qg3fkyw Using Armitage] (Metasploit Framework)]
|
:'''Lab 3:'''
::Continue Working on '''Lab 3'''
|- valign="top"
|
:'''Week 5'''
|
:'''Types of Attacks:'''
::*Client-side Attacks
:::*Phishing
:::*Webbrowser - Malicious Payloads
:::*IP Spoofing (Man in the Middle) / Password
::*Server-side Attacks
:::*Out-dated Software Patches
:::*Database Injection
:::*Password Cracking
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.ppt ppt] ] Types of Attacks
:'''YouTube Videos:'''
::*[http://www.youtube.com/watch?v=ZUygX8TBBw0 Phishing]
::*[http://www.youtube.com/watch?v=PqfZM3Lxrmg Malicious Payload]
::*[http://www.youtube.com/watch?v=-hd7XG-b6uk IP Spoofing]
::*[http://www.youtube.com/watch?v=AhTfo6pWBIM Database Injection]
::*[http://www.youtube.com/watch?v=Iyh_w0Ix2bc Password Cracking]
:'''Reading References:'''
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapters 4,5,6)
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
::*[https://github.com/WebGoat/WebGoat/wiki Webgoat]
|
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan any server.<br /><br /></ol></div>
</div>
:'''Resources:Week 6'''::* [http://www.linuxdoc.org/HOWTO/User-Authentication-HOWTO/x115.html Why Use PAM?]::* [http://www.ibm.com/developerworks/linux/library/l-pam/index.html Understanding and Configuring PAM]
More on mysql injection and Webgoat
|
::* [[https://www.youtube.com/watch?v=Rqt_BgG5YyI Blind MySQL injection video]]'''Moved until after the break'Lab 4'':'''Hardening Windows 7/8/10'''::*Installing and Configuring Security Configuration Wizard::*Using New Technology File System Hardening(NTSF)::*[httpsConfiguring Automatic Updates :'''Test #1: Details, March 6th''':://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Linux System Hardening # Quiz 2 (part 1February 22)]
|
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.ppt ppt] ] Hardening - Basic Concepts
::* [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/labs/sec520_lab5.pptx pptx] ] Hardening Windows
:'''Reading References:'''
::*[https://www.sans.org/media/score/checklists/ID-Windows.pdf Intrusion Discovery - Windows]
::* [http://lcweb.senecac.on.ca:2052/toc.aspx?site=RYW9D&bookid=12602 Hardening Windows, 2nd Edition]<br />(Chapter 5 - Pages: )
::* [http://old.honeynet.org/papers/enemy/ "Know Your Enemy: The Script Kiddie"]
:'''Midterm (Test #1) ReviewYouTube Videos:'''::*Complete Labs 1 - 5[] :'''Resources:'''::*Review for Midterm
:'''Lab 4Assignment #1:'''::Continue Working on Lab 4 * Assignment Instructions (Linux System Hardening - Part 1N/A)::Work Continue working on Assignment #1'''Lab 4''' and install Webgoat
|
:'''Week 7'''
|
:'''Midterm (Test #1March 6th):'''::*Test Details(Check course announcements for test details)
:'''Additional Tasks:'''
:'''Lab 5:'''
::*'''Hardening Windows 7/8/10'''
::Work on '''Assignment #1'''
|- valign="center"
!colspan="4"|<br />'''Study Week'''
|- valign="top"
|
:'''Week 8'''
|
:'''Slides (Concepts):Types of Penetration Testing'''::* [ [httpNetwork::*Access Control::*Infrastructure /Patching::*Physical/cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.odp odp] ] [ [httpBuilding Security://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.ppt ppt] ] Linux Hardening (part 2)*Social Engineering
:'''Slides (Concepts): See Blackboard'''
:'''ResourcesLab 6:'''::*|Work on vulnerable Windows 7 VM CTF
:'''Types of Attacks:Passwords, Pwn'ing, & Pillaging'''::*Client-side Attacks:::*Phishing:::*Webbrowser - Malicious Payloads:::*IP Spoofing (Man in the Middle) / Password::*Server-side Attacks:::*Out-dated Software Patches:::*Database Injection:::*Password Cracking
:'''Slides (Concepts):See Blackboard'''::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.ppt ppt] ] Types of Attacks
|
:'''Slides (Concepts)Lab 7:'''::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.pdf pdf] ] [ [http://cs.senecac.Continue to work on.ca/~fac/sec520/slides/sec520_w9_l1.ppt ppt] ] Intrusion Detection / Using Tripwirevulnerable Windows 7 VM CTF
|- valign="top"|:'''YouTube Videos:Week 10'''::*[http://www.youtube.com/watch?v=kUdCsZpt2ew Iptables]
|
:'''Lab 6:Metasploit and Metasploitable 2''':Attack Categories:::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_6.html Types of Attacks]
|
|
:'''Additional ConsiderationsLabs:'''::*Decoys: Honey-Pots::*DMZs::*Disaster Recovery::*The BIGGER Picture|
|
|
:'''Work on Assignment #2 Evaluation:'''::*PresentationsComplete Report::*Evaluate Secured System
|
