Difference between revisions of "SEC520 Weekly Schedule"

From CDOT Wiki
Jump to: navigation, search
(→‎SEC520 Weekly Schedule)
m (Protected "SEC520 Weekly Schedule": OER transfer ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite)))
 
(20 intermediate revisions by 2 users not shown)
Line 3: Line 3:
 
=SEC520 Weekly Schedule=
 
=SEC520 Weekly Schedule=
 
== Winter 2018==
 
== Winter 2018==
−
::Instructor:<br />Austin (SAA)
+
::Instructor:<br />Austin (SAA)<br />Craig Barretto (craig.barretto@senecacollege.ca)
 
1 credit
 
1 credit
 
::*Quiz and Labs ( 4 Quiz, 7 Labs (15%))
 
::*Quiz and Labs ( 4 Quiz, 7 Labs (15%))
 +
::::'''Logbooks due April 10th, 2018'''
 
::*Assignments (2) 20%
 
::*Assignments (2) 20%
 +
::::'''Assignment 1 - Due Date March 9''''''
 +
::::'''Assignment 2 - Due Date TBA''''''
 
::*Tests (2) 30%
 
::*Tests (2) 30%
−
::*Final Test 25%
+
::::'''Written Test - March 8''''''
 +
::::'''Lab Test - March 15'''''
 +
::*Final Test 35%
 
{|width="100%" border="1" cellspacing="2"
 
{|width="100%" border="1" cellspacing="2"
 
| style="width: 10%;" |
 
| style="width: 10%;" |
Line 53: Line 58:
 
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520  SEC520 WIKI]
 
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520  SEC520 WIKI]
 
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
 
::* [https://scs.senecac.on.ca/course/sec520 Course Outline]
−
::* [https://cs.senecac.on.ca/~scs/DonMillsPolicies/policy.html Course Policies]
+
 
−
::* [http://zenit.senecac.on.ca/wiki/index.php/SEC520#Supplies_Checklist_.28Required_for_Second_Class.29 Required Materials]
+
::* Required Materials are listed in your Supplies Checklist. Other materials and references are noted week by week.
  
  
Line 244: Line 249:
 
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
 
::*[http://atlas.arbor.net/ ATLAS Web-page] (Active Threat Level Analysis System)
 
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
 
::*[http://www.sans.org/top-cyber-security-risks/summary.php Top Security Risks 2009 (SANS Institute)]
 +
::*[https://github.com/WebGoat/WebGoat/wiki Webgoat]
  
  
Line 268: Line 274:
 
:'''Week 6'''
 
:'''Week 6'''
  
 +
More on mysql injection and Webgoat
  
 
|
 
|
  
  
 +
::* [[https://www.youtube.com/watch?v=Rqt_BgG5YyI Blind MySQL injection video]]
 +
'''Moved until after the break'''
 
:'''Hardening Windows 7/8/10'''
 
:'''Hardening Windows 7/8/10'''
 
::*Installing and Configuring Security Configuration Wizard
 
::*Installing and Configuring Security Configuration Wizard
Line 280: Line 289:
 
::# Quiz 2 (February  22)
 
::# Quiz 2 (February  22)
  
−
::Continue working on '''Lab 4'''
+
 
 
|
 
|
  
Line 309: Line 318:
 
:'''Assignment #1:'''
 
:'''Assignment #1:'''
 
::* Assignment Instructions (N/A)
 
::* Assignment Instructions (N/A)
−
 
+
::Continue working on '''Lab 4''' and install Webgoat
  
  
Line 337: Line 346:
 
:'''Lab 5:'''
 
:'''Lab 5:'''
 
::*'''Hardening Windows 7/8/10'''
 
::*'''Hardening Windows 7/8/10'''
−
::Continue working on '''Lab 5'''
 
 
::Work on '''Assignment #1'''
 
::Work on '''Assignment #1'''
  
Line 354: Line 362:
  
  
−
:'''System Hardening in Linux:'''
+
:'''Types of Penetration Testing'''
−
::*Purpose
+
::*Network
−
::*Rule of Preventative Action
+
::*Access Control
−
::*Rule of Separation
+
::*Infrastructure / Patching
−
::*Rule of Least Privilege
+
::*Physical/Building Security
−
:::*AAA Protocol (Authentication):
+
::*Social Engineering
−
::::*PKI
 
−
::::*PAM
 
−
::::*Kerebos
 
−
 
 
  
 
|
 
|
  
  
−
:'''Slides (Concepts):'''
+
:'''Slides (Concepts): See Blackboard'''
−
 
 
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1b.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1b.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w3_l1b.pptx pptx] ] Linux Hardening - Part 1
 
−
::*[[https://www.digitalocean.com/community/tutorials/how-to-use-pam-to-configure-authentication-on-an-ubuntu-12-04-vps PAM Configuration HOWTO]]
 
−
::*[[http://hexten.net/assets/pam_abl_doc/index.html PAM Auto Blacklist Module HOWTO]]
 
−
:'''Reading References:'''
 
−
 
 
−
::*[https://www.sans.org/media/score/checklists/ID-Linux.pdf Intrusion Discovery - Linux]
 
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook (E-book)]<br />(Chapter 4 - Pages: )
 
  
−
:'''YouTube Videos:'''
 
−
::*Linux Hardening
 
−
:::[http://www.youtube.com/watch?v=GJMKgV8V4FI Part1] | [http://www.youtube.com/watch?v=M9LdGH_AIZo Part 2] | [http://www.youtube.com/watch?v=0tEBXWU6Au4 Part 3]
 
−
::*[http://www.youtube.com/watch?v=yy1NR74ttAw&feature=results_main&playnext=1&list=PL48E055817B95897B PAM]
 
  
−
:'''Resources:'''
 
−
::* [http://www.linuxdoc.org/HOWTO/User-Authentication-HOWTO/x115.html Why Use PAM?]
 
−
::* [http://www.ibm.com/developerworks/linux/library/l-pam/index.html Understanding and Configuring PAM]
 
  
  
Line 392: Line 381:
  
 
:'''Lab 6:'''
 
:'''Lab 6:'''
−
::System Hardening
+
::Work on vulnerable Windows 7 VM CTF
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_6.html Linux System Hardening (part 1)]
 
  
  
Line 410: Line 398:
  
  
−
:'''System Hardening in Linux / Continued:'''
+
:'''Passwords, Pwn'ing, & Pillaging'''
−
::*AAA Protocol (Authorization):
+
 
−
:::*ACLs
 
−
:::*SELinux
 
−
:::*Sudo
 
−
:::*Cron Jobs
 
−
:::*Turning Off Xwindows
 
  
  
Line 423: Line 406:
  
  
−
:'''Slides (Concepts):'''
+
:'''Slides (Concepts): See Blackboard'''
−
::* [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w4_l1.ppt ppt] ] Linux Hardening - Part 2
 
−
 
 
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=6piQXXHTmqk ACLs]
 
−
::*[http://www.youtube.com/watch?v=fpXuWhshKVA SELinux]
 
−
::*[http://www.youtube.com/watch?v=imnEUvvDxc4 Sudo]
 
−
::*[http://www.youtube.com/watch?v=4Icg3MYZZqI Cron Jobs]
 
−
 
 
−
:'''Reading References:'''
 
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 5 - Pages: )
 
−
::*[http://lcweb.senecac.on.ca:2063/0131963694?uicode=seneca SELinux by Example]<br />(Chapter x - Pages: )
 
  
−
:'''Resources:'''
 
−
::* [http://www.linuxquestions.org/linux/answers/security/acls_extended_filepermissions How to Use ACLs]
 
−
::* SELinux
 
−
::* [http://www.sudo.ws/sudo/intro.html Sudo In a Nutshell]
 
  
  
Line 448: Line 416:
  
 
:'''Lab 7:'''
 
:'''Lab 7:'''
−
::System Hardening
+
::Continue to work on vulnerable Windows 7 VM CTF
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_7.html Linux System Hardening (part 2)]
 
−
 
 
−
 
 
−
 
 
−
:'''Assignment #2:'''
 
−
::*Assignment Instructions (N/A)
 
  
  
Line 465: Line 427:
  
  
−
:'''System Hardening in Linux / Continued:'''
+
:'''Metasploit and Metasploitable 2'''
−
::*Complete Labs 6 and 7
 
  
  
Line 481: Line 442:
  
 
:'''Labs:'''
 
:'''Labs:'''
−
::*Complete Labs 6 and 7
+
 
  
  
Line 489: Line 450:
  
 
|
 
|
−
 
−
 
−
:'''Intrusion Detection:'''
 
−
::*Purpose
 
−
::*Logs
 
−
::*Monitoring
 
−
::*Iptables
 
−
::*Using Tripwire
 
  
  
  
−
:'''Additional Considerations:'''
 
−
::*Decoys: Honey-Pots
 
−
::*DMZs
 
−
::*Disaster Recovery
 
−
::*The BIGGER Picture
 
 
|
 
|
  
  
−
 
−
:'''Slides (Concepts):'''
 
−
::*[ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.odp odp] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.pdf pdf] ] [ [http://cs.senecac.on.ca/~fac/sec520/slides/sec520_w9_l1.ppt ppt] ]  Intrusion Detection / Using Tripwire
 
−
 
−
:'''Reading References:'''
 
−
::*[http://www.sans.org/score/checklists/ID_Linux.pdf Intrusion Discovery - Linux]
 
−
::*[http://lcweb.senecac.on.ca:2063/0596003919 Linux Security Cookbook]<br />(Chapter 1 - Pages: )
 
−
 
−
:'''YouTube Videos:'''
 
−
::*[http://www.youtube.com/watch?v=kUdCsZpt2ew Iptables]
 
−
 
−
:'''Additional Resources:'''
 
−
::*
 
  
  
Line 529: Line 464:
  
 
:'''Lab 8:'''
 
:'''Lab 8:'''
−
::*[https://scs.senecac.on.ca/~fac/sec520/labs/SEC520_Lab_8.html Intrusion Detection]
+
 
  
 
|- valign="top"
 
|- valign="top"

Latest revision as of 14:57, 21 July 2023


SEC520 Weekly Schedule

Winter 2018

Instructor:
Austin (SAA)
Craig Barretto (craig.barretto@senecacollege.ca)

1 credit

  • Quiz and Labs ( 4 Quiz, 7 Labs (15%))
Logbooks due April 10th, 2018
  • Assignments (2) 20%
Assignment 1 - Due Date March 9'
Assignment 2 - Due Date TBA'
  • Tests (2) 30%
Written Test - March 8'
Lab Test - March 15
  • Final Test 35%
Week
Objectives and Tasks
Course Notes / Assigned Reading
Labs


Week 1


Course Introduction:
  • SEC520 WIKI
  • Course Outline
  • Course Policies
  • Required Materials
  • Lab Setup


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Course Intro / The "Security Mind"


Reading References:


Resources:
  • Required Materials are listed in your Supplies Checklist. Other materials and references are noted week by week.


Lab 1:
Set-Up for Labs:



Week 2


Developing a "Security Mind":
  • 4 Virtues of Internet Security
  • 8 Rules of Internet Security
  • Penetration Testing:
  • Reconnaissance:
  • Information Gathering
  • Foot-printing
  • User Information
  • Verification


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Penetration Testing: Reconnaissance
Reading References:
YouTube Videos:



Lab 2:
Pentration Testing:



Week 3


Scanning, Enumeration, & Vulnerability Testing:
  • Penetration Testing (Continued):
  • Scanning
  • Enumeration
  • Vulnerability Testing


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Scanning & Enumeration


Reading References:
YouTube Videos:
Resources:



Lab 3:
Penetration Testing / Continued:




Week 4


Scanning, Enumeration, & Vulnerability Testing:
  • Vulnerability Testing


Slides (Concepts):
  • [ odp ] [ pdf ] [ ppt ] Vulnerability Testing


Reading References:
YouTube Videos:
Resources:



Lab 3:
Continue Working on Lab 3



Week 5


Types of Attacks:
  • Client-side Attacks
  • Phishing
  • Webbrowser - Malicious Payloads
  • IP Spoofing (Man in the Middle) / Password
  • Server-side Attacks
  • Out-dated Software Patches
  • Database Injection
  • Password Cracking


Slides (Concepts):
YouTube Videos:
Reading References:
Resources:


Lab 4:
Attack Categories:


WARNINGS!
  1. Scanning ports must require the permission of Server Owner (preferably in writing). Student must either work in Security lab to scan each others' ports, or sign an agreement to scan any server.



Week 6

More on mysql injection and Webgoat


Moved until after the break

Hardening Windows 7/8/10
  • Installing and Configuring Security Configuration Wizard
  • Using New Technology File System (NTSF)
  • Configuring Automatic Updates
Test #1: Details, March 6th
  1. Quiz 2 (February 22)


Slides (Concepts):
Reading References:
YouTube Videos:
  • []
Resources:




Assignment #1:
  • Assignment Instructions (N/A)
Continue working on Lab 4 and install Webgoat



Week 7


Midterm (Test #1 March 6th):
  • (Check course announcements for test details)




Additional Tasks:
Lab 5:
  • Hardening Windows 7/8/10
Work on Assignment #1

Study Week



Week 8


Types of Penetration Testing
  • Network
  • Access Control
  • Infrastructure / Patching
  • Physical/Building Security
  • Social Engineering


Slides (Concepts): See Blackboard


Lab 6:
Work on vulnerable Windows 7 VM CTF



Assignment #1 Due



Week 9


Passwords, Pwn'ing, & Pillaging


Slides (Concepts): See Blackboard
Lab 7:
Continue to work on vulnerable Windows 7 VM CTF


Week 10


Metasploit and Metasploitable 2





Labs:


Week 11





Lab 8:


Week 12


Work on Assignment #2
  • Complete Report
Assignment #2 Due:



Week 13


Final Exam Review
  • Details



Exam Week - TBA
Retrieved from "https://wiki.cdot.senecapolytechnic.ca/w/index.php?title=SEC520_Weekly_Schedule&oldid=160563"