1,576
edits
Changes
m
::* [https://cs.senecac.on.ca/~scs/DonMillsPolicies/policy.html Course Policies]::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520#Supplies_Checklist_ Required Materials are listed in your Supplies Checklist.28Required_for_Second_ClassOther materials and references are noted week by week.29 Required Materials]
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
::* [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.odp odp] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.pdf pdf] ] [ [http://matrix.senecac.on.ca/~murray.saul/tank-rules.ppt ppt] ] Interpreting and Respecting the Rules for the Tank Server
:'''Test #2:'''
::*Test Details
:'''Resources:'''
::*
:'''Lab 4:'''
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Hardening Windows 2003 Server]
:'''Assignment #1:'''
::* Assignment Instructions (N/A)
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w7_l1.ppt ppt] ] Types of Attacks
:'''YouTube Videos:'''::*[ [http://wwwcs.youtubesenecac.comon.ca/watch?v=ZUygX8TBBw0 Phishing~fac/sec520/slides/sec520_w3_l1.odp odp]] [ [http::*//cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://wwwcs.senecac.youtubeon.comca/~fac/sec520/slides/watch?v=PqfZM3Lxrmg Malicious Payloadsec520_w3_l1.ppt ppt]] Hardening - Basic Concepts::*[ [http://wwwcs.youtubesenecac.comon.ca/watch?v=-hd7XG-b6uk IP Spoofing~fac/sec520/labs/sec520_lab5.odp odp] ]::*[ [http://wwwcs.youtubesenecac.comon.ca/watch?v=AhTfo6pWBIM Database Injection~fac/sec520/labs/sec520_lab5.pdf pdf] ]::*[ [http://wwwcs.senecac.youtubeon.comca/~fac/sec520/labs/watch?v=Iyh_w0Ix2bc Password Crackingsec520_lab5.pptx pptx] ] Hardening Windows
:'''Lab 5:'''
:Attack Categories:
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_5.html Types of Attacks]
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan the Tank server within or outside Seneca College.<br /><br /><li>'''Your instructor will hand-out permission forms to allow students to obtain Tank accounts, and allow students to perform ethical "penetration testing" on that server'''. Students <b><u>must</u></b> sign this form, hand back to the instructor, and await further instructions before proceeding with penetration testing on the tank server</li></ol></div>
</div>
:'''YouTube Videos:'''
::*Linux Hardening
:::[http://www.youtube.com/watch?v=GJMKgV8V4FI Part1] | [http://www.youtube.com/watch?v=M9LdGH_AIZo Part 2] | [http://www.youtube.com/watch?v=0tEBXWU6Au4 Part 3]
::*[http://www.youtube.com/watch?v=yy1NR74ttAw&feature=results_main&playnext=1&list=PL48E055817B95897B PAM]
:'''Resources:'''
::* [http://www.linuxdoc.org/HOWTO/User-Authentication-HOWTO/x115.html Why Use PAM?]
::* [http://www.ibm.com/developerworks/linux/library/l-pam/index.html Understanding and Configuring PAM]
:'''Resources:'''
::* [http://www.linuxquestions.org/linux/answers/security/acls_extended_filepermissions How to Use ACLs]
::* SELinux
::* [http://www.sudo.ws/sudo/intro.html Sudo In a Nutshell]
::*Complete Labs 6 and 7
:'''Intrusion Detection:'''
::*Purpose
::*Logs
::*Monitoring
::*Iptables
::*Using Tripwire
:'''Additional Considerations:'''
::*Decoys: Honey-Pots
::*DMZs
::*Disaster Recovery
::*The BIGGER Picture
:'''Slides (Concepts):'''
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.ppt ppt] ] Intrusion Detection / Using Tripwire
:'''Reading References:'''
::*[http://www.sans.org/score/checklists/ID_Linux.pdf Intrusion Discovery - Linux]
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 1 - Pages: )
:'''YouTube Videos:'''
::*[http://www.youtube.com/watch?v=kUdCsZpt2ew Iptables]
:'''Additional Resources:'''
::*
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_8.html Intrusion Detection]
Protected "SEC520 Weekly Schedule": OER transfer ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))
[[Category:SEC520]]
=SEC520 Weekly Schedule=
== Winter 2018==
::Instructor:<br />Austin (SAA)<br />Craig Barretto (craig.barretto@senecacollege.ca)
1 credit
::*Quiz and Labs ( 4 Quiz, 7 Labs (15%))
::::'''Logbooks due April 10th, 2018'''
::*Assignments (2) 20%
::::'''Assignment 1 - Due Date March 9''''''
::::'''Assignment 2 - Due Date TBA''''''
::*Tests (2) 30%
::::'''Written Test - March 8''''''
::::'''Lab Test - March 15'''''
::*Final Test 35%
{|width="100%" border="1" cellspacing="2"
| style="width: 10%;" |
:'''Reading References:'''
::* [http://lcweb.senecac.on.ca:2053/0596006691 Computer Security Basics (E-book)]<br />(Chapter 1: The New Insecurity)
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=86056&recCount=50&recPointer=0&bibId=263746 Inside the Security Mind, Making the Tough Decisions (E-Book)] (Chapters 1 - 3)
::* [http://libcat.senecac.on.ca/vwebv/holdingsInfo?searchId=89542&recCount=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter 2: Reconnaissance)
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520 SEC520 WIKI]
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Scanning 1] , [http://www.youtube.com/watch?v=WKLNAAt57Wg Scanning 2]
::*[http://www.youtube.com/watch?v=_Ch0RJlHFBo Enumeration]
::*[https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap Online Pen-Test Scanner]::*[https://www.youtube.com/watch?v=dR7NTYfmNcA Prep for Metasploit]
:'''Resources:'''
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
</div>
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w2_l2.ppt ppt] ] Vulnerability Testing
:'''Reading References:'''
:'''Resources:'''
::*[https://www.youtube.com/watch?v=r4Qq2eVjiP0 Setting up the Metasploit database]::*[https://www.youtube.com/watch?v=x01ZErjNlX0 First Metasploit Payload]::*[http://www.commonexploitsyoutube.com/watch?pv=243 jJd5qg3fkyw Using Armitage] (Metasploit Framework)]
:'''Lab 3:'''
::Continue Working on '''Lab 3'''
|
:'''Week 5'''
|
:'''Hardening Windows 2003 ServerTypes of Attacks:'''::*Installing and Configuring Security Configuration WizardClient-side Attacks:::*Phishing:::*Webbrowser - Malicious Payloads:::*Using New Technology File System IP Spoofing (NTSFMan in the Middle)/ Password::*Server-side Attacks:::*Out-dated Software Patches:::*Database Injection:::*Configuring Automatic UpdatesPassword Cracking
:'''Slides (Concepts):'''
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1sec520_w7_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1sec520_w7_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w8_l1sec520_w7_l1.ppt ppt] ] Hardening WindowsTypes of Attacks :'''YouTube Videos:'''::*[http://www.youtube.com/watch?v=ZUygX8TBBw0 Phishing]::*[http://www.youtube.com/watch?v=PqfZM3Lxrmg Malicious Payload]::*[http://www.youtube.com/watch?v=-hd7XG-b6uk IP Spoofing]::*[http://www.youtube.com/watch?v=AhTfo6pWBIM Database Injection]::*[http://www.youtube.com/watch?v=Iyh_w0Ix2bc Password Cracking]
:'''Reading References:'''
::*[http://www.sans.org/score/checklists/ID_Windows.pdf Intrusion Discovery - Windows]::* [http://lcweblibcat.senecac.on.ca:2052/toc.aspxvwebv/holdingsInfo?sitesearchId=RYW9D89542&bookidrecCount=12602 Hardening Windows, 2nd Edition50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)]<br />(Chapter Chapters 4,5 - Pages,6) :'''Resources: )'''
:'''YouTube Videos:'''*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)::*[http://www.youtubesans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]::*[https://github.com/watch?v=df1_yx2fa8g Security Configuration Wizard 2003WebGoat/WebGoat/wiki Webgoat]
:'''Lab 4:'''
:Attack Categories:
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_4.html Types of Attacks]
<div class="messagebox" style="background-color: #f9f6b7; border: 1px solid #c4c295; color: black; padding: 5px; margin: 1ex 0; min-height: 35px; margin-left:15px; margin-right:10px; padding-left: 20px;">
<div style="float: left; margin-left: -40px;"></div>
<div><b>WARNINGS!</b><br /><ol><li>'''Scanning ports must require the permission of Server Owner''' (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan any server.<br /><br /></ol></div>
</div>
|- valign="top"
|
:'''Week 6'''
More on mysql injection and Webgoat
|
::* [[https://www.youtube.com/watch?v=Rqt_BgG5YyI Blind MySQL injection video]]'''Types of Attacks:Moved until after the break'''::*Client-side Attacks'''Hardening Windows 7/8/10''':::*PhishingInstalling and Configuring Security Configuration Wizard:::*Webbrowser - Malicious Payloads:::*IP Spoofing Using New Technology File System (Man in the MiddleNTSF) / Password::*Server-side Attacks:::*Out-dated Software Patches:::*Database Injection:::*Password CrackingConfiguring Automatic Updates
:'''Test #1: Details, March 6th'''
::# Quiz 2 (February 22)
:'''Slides (Concepts):'''
:'''Reading References:'''
::*[https://www.sans.org/media/score/checklists/ID-Windows.pdf Intrusion Discovery - Windows]::* [http://libcatlcweb.senecac.on.ca:2052/vwebv/holdingsInfotoc.aspx?searchIdsite=89542RYW9D&recCountbookid=50&recPointer=0&bibId=315433 Penetration Tester's Open Source Toolkit (E-book)12602 Hardening Windows, 2nd Edition]<br />(Chapters 4,Chapter 5,6- Pages: )::* [http://old.honeynet.org/papers/enemy/ "Know Your Enemy: The Script Kiddie"] :'''YouTube Videos:'''::*[]
:'''Resources:'''
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
|
:'''Additional TasksAssignment #1:'''::Work * Assignment Instructions (N/A)::Continue working on '''Assignment #1Lab 4'''and install Webgoat
:'''Midterm (Test #1March 6th):'''
::*(Check course announcements for test details)
:'''Additional Tasks:'''
::Continue working on '''Lab 5:'''::*'''Hardening Windows 7/8/10'''
::Work on '''Assignment #1'''
|- valign="center"
!colspan="4"|<br />'''Study Week'''
|- valign="top"
:'''System Hardening in Linux:Types of Penetration Testing'''::*Purpose::*Rule of Preventative Action::*Rule of Separation::*Rule of Least PrivilegeNetwork:::*AAA Protocol (Authentication):Access Control::::*PKIInfrastructure / Patching::::*PAMPhysical/Building Security::::*KerebosSocial Engineering
|
:'''Slides (Concepts):See Blackboard'''::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1.ppt ppt] ] Linux Hardening (part 1) :'''Reading References:'''::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook (E-book)]<br />(Chapter 4 - Pages: )
:'''Lab 6:'''
::System HardeningWork on vulnerable Windows 7 VM CTF ::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_6.html Linux System Hardening (part 1)]
:'''Assignment #1 Due'''
:'''System Hardening in Linux / Continued:Passwords, Pwn'ing, & Pillaging'''::*AAA Protocol (Authorization)::::*ACLs:::*SELinux:::*Sudo:::*Cron Jobs:::*Turning Off Xwindows
:'''Slides (Concepts):See Blackboard'''::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.ppt ppt] ] Linux Hardening (part 2) :'''YouTube Videos:'''::*[http://www.youtube.com/watch?v=6piQXXHTmqk ACLs]::*[http://www.youtube.com/watch?v=fpXuWhshKVA SELinux]::*[http://www.youtube.com/watch?v=imnEUvvDxc4 Sudo]::*[http://www.youtube.com/watch?v=4Icg3MYZZqI Cron Jobs] :'''Reading References:'''::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 5 - Pages: )::*[http://lcweb.senecac.on.ca:2063/0131963694?uicode=seneca SELinux by Example]<br />(Chapter x - Pages: )
:'''Lab 7:'''
::System Hardening::*[https://scs.senecac.Continue to work on.ca/~fac/sec520/labs/SEC520_Lab_7.html Linux System Hardening (part 2)] :'''Assignment #1 Due''' :'''Assignment #2:'''::*Assignment Instructions (N/A)vulnerable Windows 7 VM CTF
:'''System Hardening in Linux / Continued:Metasploit and Metasploitable 2'''::*Complete Labs 6 and 7
:'''Labs:'''
|
|
:'''Lab 8:'''
|- valign="top"
